Patent ID: 8255996

Claim:
In a security management device, a method of detecting and mitigating a network threat, comprising: providing false data about a network topology in which the security management device operates to a source of a network threat, wherein the false data is provided by the security management device responsive to a probe received at a virtual decoy established by the security management device within otherwise unused address space available to the network topology; receiving mirrored traffic from a network switch communicably interfaced with the security management device, wherein the mirrored traffic is a copy of traffic in a communication stream initially received at the network switch and suspected to be undesired traffic by the network switch, and wherein the security management device is to conduct threat analysis on the mirrored network traffic received; analyzing the mirrored traffic to determine the source of the undesired traffic and the network threat based on information within the mirrored traffic and based on information provided by the network switch; causing the communication stream initially received at the network switch to be sent from the source of the undesired traffic and the network threat to the security management device instead of the network switch targeted by the source using a reformulated ARP table of the source, and based further on one or more of Access Control Lists (ACLs), policy-based routing, Virtual Local Area Network Identifications (VLAN IDs), HyperText Transfer Protocol (HTTP) information, or Extensible Markup Language (XML) tags; and blocking traffic from the source of the undesired traffic and the network threat at the security management device.