Patent ID: 8510821

Claim:
A system for performing tiered network flow analysis, the system comprising: a computer system comprising one or more processors, the computer system programmed to implement: a first-tier analysis module and a second-tier analysis module; wherein the first-tier analysis module, executing on at least one of the one or more processors, is configured to: receive a first portion of a network flow associated with a recipient; perform a first-tier analysis, having a first computational cost, on the first portion of the network flow to detect any matches to a first set of criteria; and in response to detecting a match to the first set of criteria during the first-tier analysis of the first portion of the network flow, flagging the network flow to be subsequently mirrored to the second-tier analysis module for further analysis, and forwarding the network flow to the recipient; and wherein the second-tier analysis module, executing on at least one of the one or more processors, is configured to: perform a second-tier analysis, having a second computational cost that is greater than the first computational cost, on a second portion of the network flow mirrored by the first-tier analysis module; and in response to detecting any matches to a second set of criteria during the second-tier analysis of the second portion of the network flow, perform an action in response to matching the second set of criteria, wherein said action comprises at least one of: terminating the network flow; quarantining the network flow; or throttling the network flow.