Patent ID: 8607346

Claim:
A method comprising: receiving, with a network device, a packet of a packet flow within a network; processing the packet using intrusion detection software executing on the network device to determine whether the packet flow represents a network attack, the intrusion detection software comprising a processing engine and a plurality of protocol decoders; detecting a process exception that occurs during processing of the packet; identifying a memory location associated with the process exception; determining whether the process exception was caused by one of the plurality of protocol decoders or the processing engine based on the memory location associated with the process exception; determining that the process exception was caused by one of the plurality of protocol decoders: handling the process exception and continuing execution of the intrusion detection software; determining which one of the plurality of protocol decoders caused the process exception based on packet flow information associated with the packet being processed when the process exception occurred; disabling the decoder that caused the process exception; storing information identifying a collection of exempt decoders including the disabled decoder and any other previously disabled decoders; compiling, with the network device, a new policy of the decoders to be applied to the processing engine based at least in part on the stored collection, wherein the new policy excludes the exempt decoders; and removing, with the network device, one of the disabled decoders from the collection of exempt decoders upon detecting that an updated version for the one the disabled decoder is available for the intrusion detection software.