Patent ID: 7765313

Claim:
A classification engine capable of receiving a plurality of protocol data units (PDUs) and performing a tree-based classification on the PDUs, the classification engine comprising: input means for receiving the PDUs; control means for supplying raw protocol data and control information as parameters of the received PDUs; parsing means, controlled by said control means, said parsing means capable of parsing the PDUs to generate an abstracted protocol structure for at least one of the PDUs, said parsing means further for applying a protocol syntax check on the raw protocol data of the PDU; a classifier that classifies the PDUs based on a protocol associated with the PDU, and said classifier sub-classifies the classified PDUs, based on sub-protocols with the protocol, to isolate traffic and to isolate commands associated with the isolated traffic; said classifier performs policy enforcement for the PDUs that includes at least one of: access control, stateful firewall control, and quality control; said control means call a finite state machine for the classifier and supply the abstracted protocol structure and control information for the received PDUs; said finite state machine capable to update a stream table with protocol specific state variables; said finite state machine modifies the abstracted protocol structure, based on at least one policy parameter associated with the at least one of the received PDUs; if a received PDU is denied, said classifier performs at least one of: modifies the PDU to return a useful message to the sender, ignoring the denied data and not passing said data to a destination and terminates the connection; and output means for transmitting the PDUs, tagged only with the modified abstracted protocol structure, based on the updated stream table.