Patent ID: 8683573

Claim:
An apparatus for providing computer security, comprising: a processor; a non-transitory computer readable storage medium (CRSM) coupled to the processor; and logic, stored on the CRSM and executed on the processor, for: examining a packet to determine whether the packet is an incoming packet or an outgoing packet, wherein the packet corresponds to a source internet protocol (IP) address, a destination IP address and a port number; processing an outgoing packet, comprising storing in a table, in conjunction with the source IP address and the port number, an indication that the source IP address represents a potential threat; and processing an incoming packet, comprising: correlating the destination IP address and port number with source IP address and port numbers, respectively of entries in the table; and if the destination IP address and the port number match a source IP address and port number of an entry in the table, storing, in all entries in the table with a source IP address corresponding to the destination IP address, an indication that the source IP represents a non-threat; and if the destination IP address matches a source IP address and the port number does not correlate to a corresponding port number, storing, in conjunction with all entries in the table with a source IP address corresponding to the destination, an indication that the source IP address represents a threat.