Patent ID: 7681235

Claim:
A method for protecting a network, the method comprising: measuring in real-time a property of traffic entering the network; analyzing, by an attack detection module, the property in real-time using at least one detection algorithm in order to detect an attack; upon detection of the attack, developing, by a signature detection module, a plurality of signatures each of which characterizes packets participating in the detected attack, and organizing the signatures into a group ordered by respective levels of specificity of the signatures for characterizing the packets participating in the attack; using a filtering algorithm, filtering the traffic entering the network that is characterized by a first one of the signatures having a highest level of specificity among the group of signatures, in order to block traffic participating in the attack and allow filtered traffic to pass into the network; periodically analyzing, by the attack detection module, the filtered traffic that passed into the network and was not blocked by the filtering algorithm, using the at least one detection algorithm; and upon finding, using a feedback control loop having as input the analysis of the filtered traffic, that the filtering algorithm is not successfully blocking the traffic participating in the attack, increasing a level of restrictiveness of the filtering by blocking the traffic entering the network that is characterized by, using an “OR” relationship, the first one of the signatures or a second one of the signatures having a lower level of specificity than the first one of the signatures, wherein the at least one detection algorithm comprises at least one fuzzy logic detection algorithm, and wherein analyzing comprises analyzing the property using the at least one fuzzy logic detection algorithm, wherein measuring the property comprises determining a parameter characteristic of the traffic, and wherein analyzing the property comprises fuzzifying the parameter using an input membership function of the at least one fuzzy logic algorithm, and wherein fuzzifying the parameter comprises determining a degree of membership using the input membership function, and wherein analyzing the property further comprises applying the degree of membership to an output membership function.