Patent ID: 8286243

Claim:
A method of protecting a network from intrusions, the method comprising: detecting an intrusion of an offending packet communicated by an offending host coupled to a protected network, wherein the offending host comprises a server computer upon which is executed an operating system and at least one application that originates the offending packet; and in response to detecting the intrusion of the offending packet, returning a blocking instruction to the offending host to initiate an intrusion protection operation on the offending host, wherein the blocking instruction inhibits further origination of offending packets by the application executed upon the offending host, and wherein returning the blocking instruction further comprises sending at least a portion of the offending packet back to the offending host with the blocking instruction; wherein the intrusion protection operation comprises, at the offending host: receiving the blocking instruction and the portion of the offending packet; verifying that the offending packet originated from the offending host; and inhibiting transmission of a subsequent outbound offending packet by the offending host based on an intrusion policy, wherein inhibiting transmission further comprises: returning the subsequent outbound offending packet to the application, wherein the offending packet and the subsequent outbound offending packet originated from the application; and ending a connection with the application.