Patent ID: 8230506

Claim:
A network security system, comprising: a plurality of processing nodes comprising processing devices external to network edges of a plurality of external systems, each processing node further comprising: a processing node data store storing security policy data defining security policies for each of the external systems; a traffic processor configured to identify embedded resource request identifiers in resource requests in data traffic to and from the external system by inspecting path parameters, query parameters, and post parameters associated with the resource requests for predetermined encoded prefix data, wherein the inspecting comprises determining a corresponding prefix window for the predetermined encoded prefix data; incrementally traversing the resource request with each corresponding prefix window by filling and emptying the prefix window in the manner of a circular buffer; and a processing node manager in data communication with the traffic processor and the processing node data store and configured to access the security policy data stored in the processing node data store and perform one or more filtering operations on the embedded resource request identifiers, the filtering operations being in accordance with the security policies defined in the security policy data, and resulting in either allowance of the embedded resource request identifier or preclusion of the embedded resource request identifier.