Patent ID: 7496962

Claim:
A computer-implemented hypertext transport protocol inspection engine for decoding an obfuscated universal resource identifier in a communication packet transmitted in a packet network, for use with an intrusion detection system, comprising: a hypertext transport protocol policy selection component configured to identify a Web server hypertext transport protocol intrusion detection policy associated with a packet, responsive to the packet which is uninspected, so as to determine if the packet is moving to or from a Web server, the hypertext transport protocol policy selection component identifying the Web server hypertext transport protocol intrusion detection policy by using an Internet protocol address obtained from the packet parsed by the intrusion detection system as a key to a keyword trie associating Internet protocol addresses with Web server hypertext transport protocol intrusion detection policies; a request universal resource identifier discovery component configured to locate a universal resource identifier in the packet based on the Web server hypertext transport protocol intrusion detection policy; and a universal resource identifier normalization module configured to decode an obfuscation within the universal resource identifier after it is located by the request universal resource identifier discovery component.