Patent ID: 8375444

Claim:
A dynamic signature creation and enforcement system comprising: a tap configured to copy network data from a communication network; and a controller coupled to the tap and configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if a portion of the copy of the network data is suspicious, flag the portion of the copy of the network data as suspicious based on the heuristic determination, replay transmission of the portion of the copy of the network data that was flagged as suspicious to a destination device to identify unauthorized activity, generate an unauthorized activity signature based on the identification, and transmit the unauthorized activity signature to a digital device configured to enforce the unauthorized activity signature; wherein to replay transmission of the portion of the copy of the network data that was flagged as suspicious to a destination device the controller is further configured to retrieve a virtual machine configured to receive the portion of the copy of the network data that was flagged as suspicious, configure a replayer to transmit the portion of the copy of the network data that was flagged as suspicious to the virtual machine, receive a response from the virtual machine, the response based on the virtual machine's processing of the portion of the copy of the network data that was flagged as suspicious, and analyze the response by the virtual machine to identify unauthorized activity.