Patent ID: 8646081

Claim:
A method of operating a communication network having an ingress point and an egress point to detect security events in packet flows, the method comprising: at the ingress point, receiving a packet flow from a first communication device; copying the packet flow, transmitting the packet flow to the egress point over a network path, and processing the copy to determine if the packet flow represents a security event, wherein the security event comprises a virus; if the packet flow represents the security event, then transmitting a blocking instruction for the packet flow to the egress point over an alarm link that is faster than the network path, wherein the blocking instruction reaches the egress point before the packet flow reaches the egress point, and at the egress point, blocking the packet flow representing the security event, processing the packet flow representing the security event to remove the virus from the packet flow, resulting in a clean packet flow, transmitting the clean packet flow to a second communication device, and transmitting a security message to the second communication device, wherein the security message instructs the second communication device to determine whether recent packet flows were previously received from the first communication device, and if the recent packet flows were previously received from the first communication device, process the recent packet flows to remove the virus from the recent packet flows; and if the packet flow does not represent the security event, then at the egress point, transmitting the packet flow to the second communication device.