Patent ID: 7895652

Claim:
A computer system for detecting network attacks within encrypted network traffic received by a protected network comprising: a sensor module comprising storage media storing processor executable instructions to receive and analyze network traffic for attacks; and a security module comprising storage media storing processor executable instructions to decrypt encrypted network traffic and create decrypted traffic, provide identification of the decrypted traffic as preprocessed network traffic before it is sent to the sensor module, wherein providing identification of the decrypted traffic comprises changing the destination IP address and port number of each decrypted packet to a predetermined IP address and port number that identifies the decrypted packet as being preprocessed, and send the decrypted traffic to the sensor module, wherein the sensor module further comprises processor executable instructions to analyze both the encrypted network traffic and the decrypted traffic provided by the security module for attacks or other anomalous behavior, wherein the security module further comprises processor executable instructions to maintain a temporary mapping of encrypted network packets and decrypted network packets, wherein the sensor module further comprises processor executable instructions to block decrypted network packets received from the security module if a threat is detected, and wherein the security module further comprises processor executable instructions to detect when the sensor module blocks a decrypted network packet and to block an encrypted sensor packet corresponding to the decrypted packet blocked by the sensor module.