Patent ID: 7984171

Claim:
A method of intercepting network communications to secure communications connections to a computer from unauthorized network connections in a real-time environment, the method comprising: performing an analysis of a communications configuration in a computer; analyzing a plurality of network shares in the computer; retrieving all media address codes (MAC) and Internet protocol (IP) addresses in the computer; configuring the computer for secure communications by not allowing access to an administrative root folder share and an administrative hard drive share, if no approved policy exists to define the communications activity as an authorized event, and allowing IP address connections only with an approved policy to define the communications activity as an authorized event; executing a first parallel thread to monitor the network shares in the computer by establishing an interface to an application programming interface (API) of an operating system of the computer, checking for the existence of an administrative hard drive share and, if present, removing it, checking for the existence of an administrative root folder share and, if present, removing it, and obtaining an active shares list, starting another parallel thread to monitor network shares, and, if a new network share has been created, deleting the new network share according to a predetermined policy, and continuing to monitor the network shares; and executing a second parallel thread to monitor TCP and UDP tables in the computer by retrieving the UDP table and entries and logging UDP communications to a data file, and retrieving the TCP table and entries and logging TCP communications to another data file and, if a TCP connection is not allowed by the approved policy, terminating the TCP connection and logging the event to said another data file or, if the TCP connection is allowed by the approved policy, logging the event to said another data file.