Patent ID: 8356349

Claim:
A method of preventing intrusion in communication traffic directed toward a set of machines in a network from an external network, said traffic comprising communication entities, the method comprising the steps of: providing a test system comprising test facilities replicating at least one of said machines in said set, wherein configurations and services of said machines are replicated within said test system to detect possibly adverse effects caused by any potentially dangerous communication entity before said potentially dangerous communication entity reaches said machines, said test system being inhibited from communicating with said external network; receiving said communication entities and detecting attacks caused by said communication entities; blocking said communication entities in response to detection of attacks, or determining whether said communication entities are unlawful or suspicious in response to detection of no attacks; in response to determining that said communication entities are unlawful or suspicious, directing said communication entities in said traffic toward said test system; running said communication entities directed toward said test system on said test facilities to detect the possibly adverse effects on said test system using the replicated configurations and services running on the test system; and i) in the presence of an adverse effect, blocking the communication entities leading to said adverse effect, and ii) in the absence of an adverse effect, directing the communication entities not having the adverse effect to said set of machines.