Patent ID: 8074277

Claim:
A method implemented in a computer comprising at least one processor and a memory for detecting and preventing network intrusion, the computer having a TCP/IP (Transmission Control Protocol/Internet Protocol) communication stack to communicate with the network through a connected network adapter, the method comprising: defining intrusion descriptions specifying both general and application-specific exploits that may be attempted by malicious network traffic, said application-specific intrusion descriptions indicating specific applications that may be targeted by individual exploits, said application-specific intrusion descriptions also including extended attributes indicating application states and modes of operation of said specific applications that may be targeted by the individual exploits; each time a particular application of a given configuration establishes a new network connection, determining a current application state and mode of operation of the particular application and deriving a subset of the intrusion descriptions with extended attributes that characterize whether the current state and mode of operation of the particular application are targeted by exploits; intercepting network traffic at first and second locations for detecting and preventing intrusion, wherein at the first location network traffic is intercepted between the network adapter and the TCP/IP communication stack and at the second location network traffic is intercepted between the TCP/IP communication stack and the particular application; for the network traffic destined for the particular application that is intercepted at the second location, detecting, based on the subset of the intrusion descriptions specifically applicable to that application and based on current state and mode of operation of the particular application, whether the network traffic destined for the particular application is an attempted network intrusion; and if a network intrusion is detected, blocking network traffic destined for the particular application determined to comprise an exploit.