Patent ID: 8112800

Claim:
A method comprising: receiving, with a network device, a packet flow within a network, wherein the packet flow includes more than one type of application-layer communication protocol; performing an initial analysis of the packet flow to identify a first type of software application and application-layer communication protocol associated with the packet flow; performing a subsequent analysis of the packet flow to identify a second type of software application and application-layer communication protocol that is using the first type of software application and application-layer communication protocol as a data transport, wherein each of the first type of application-layer communication protocol and the second type of application-layer communication protocol comprises an independent application-layer communication protocol; applying a plurality of stacked application-layer decoders to the packet flow to process first application-layer data for the identified first type of software application and extract second application-layer data associated with the second type of software application encapsulated within the first application-layer data, and to process the extracted second application-layer data for the identified second type of software application; applying one or more sets of patterns to the first application-layer data and the second application-layer data to determine whether the packet flow represents a network attack; and forwarding the packet flow when the packet flow does not represent a network attack.