Patent ID: 7610624

Claim:
A system for protecting a computer network, the system comprising at least one computer device, the at least one computer device having one or more modules, including: a detection module configured to: monitor one or more packets received from a source device to determine whether one or more of the received packets include one or more harmful computer code signatures, and to further monitor the received packets to determine whether one or more of the received packets include identifying information that has a history of being included in packets associated with one or more previous attacks directed at a target device coupled to the network; and detect an attack directed at the target device if one or more of the monitored packets include one or more of the harmful computer code signatures, and to further detect the attack if one or more of the monitored packets include the identifying information that has the history of being included in packets associated with the previous attacks directed at the target device; a scanning module configured to determine a severity of the detected attack directed at the target device; a log creating module configured to create an attack profile based on information associated with the detected attack, wherein the attack profile provides identifying information included in the monitored packets that include the harmful computer code signatures, and wherein the attack profile further provides the identifying information that has the history of being included in packets associated with the previous attacks directed at the target device; and a blocking module configured to: block one or more of the monitored packets from being transmitted to the target device, wherein the blocked packets include the identifying information provided in the attack profile, and wherein the blocking module is further configured to disable a communication channel connecting the source device to the target device to block the packets from being transmitted to the target device; block one or more subsequently received packets from being transmitted to the target device if the severity of the detected attack exceeds a predetermined threshold, wherein the subsequently blocked packets include packets originating form the source device and packets directed to the target device; notify a user if the source device originates internally to a defined perimeter of the target device, wherein the user is notified that the communication channel has been disabled and that the attack originated internally to the defined perimeter of the target device; and enable the communication channel for at least one system that runs a valid application over the communication channel if the source device originates externally to the defined perimeter of the target device.