Patent ID: 8856920

Claim:
A system that is configured to process network traffic for lawful intercept surveillance, the system comprising: an equipment including: an archive that is configured to store intercepted network traffic traversing a communications network, said intercepted network traffic comprising benign traffic and malicious traffic, wherein said intercepted traffic is received at said archive from a service provider; a traffic separator that is configured to separate said benign traffic of said archive from said malicious traffic of said archive, and generate clean traffic from said benign traffic; wherein the traffic separator is a Virtual Local Area Network (VLAN) switch or a packet data unit filter/blocker; an analysis application that is configured to receive said clean traffic and analyze said clean traffic; an attack detection module coupled to the communications network that is configured to receive the intercepted network traffic, identify the benign traffic as benign, and identify the malicious traffic as malicious; and a tagging module, coupled to an output of the attack detection module, that is configured to receive the benign traffic and the malicious traffic from the attack detection module, tag each malicious packet of the malicious traffic with an associated indicator indicating that the malicious packet is malicious, generate a respective tagged malicious packet, tag each benign packet of the benign traffic with an associated indicator indicating that the benign packet is benign, generate a respective tagged benign packet, and send the respective tagged malicious packet and the respective tagged benign packet to the archive for storage, wherein the traffic separator performs the separating of the benign traffic from the malicious traffic with use of the indicator associated with each malicious packet and the indicator associated with each benign packet.