Patent ID: 7602731

Claim:
An apparatus for enforcing network policies and preventing attacks related to header, state, rate and content anomalies, said apparatus comprising: a) a Packet Interface programmed for receiving inbound/outbound packets, storing the packets in a memory buffer, releasing the packet with a packet-id to subsequent blocks for inspection, dropping the packets altogether, and sending the packets onto forensic ports based on a unified decision; b) a Classifier coupled to the Packet Interface and programmed for classifying packets received from the Packet Interface, and retrieving layer 2 , layer 3 , layer 4 , and layer 7 header information from the packets; c) a Header and State Anomaly Prevention Engine coupled to the Classifier via a classification bus and programmed for determining layers 2 , 3 , 4 , and 7 header and state anomalies; d) a Continuous and Adaptive Rate Anomaly Prevention Engine coupled to the classification bus and programmed for determining and estimating rate thresholds for layers 2 , 3 , 4 , and 7 parameters and subsequently determining rate anomalies for these parameters; e) a Recon Prevention Engine coupled to the classification bus and programmed for determining recon activities at layers 3 and 4 ; f) a Content Anomaly Engine coupled to the classification bus and programmed for determining known attacks using signatures; g) a Policy Lookup Engine coupled to the classification bus and programmed for determining policy violation in packets; and h) a Decision Multiplexer for generating the unified decision about a packet-id based on information received from a plurality of sources including the Header and State Anomaly Prevention Engine, the Continuous and Adaptive Rate Anomaly Prevention Engine, the Recon Prevention Engine, the Content Anomaly Engine, and the Policy Lookup Engine; wherein the Classifier further comprises: layers 2 , 3 , 4 , and 7 classifiers; a Fragment Reassembly Engine for assembling the packets; a Transmission Control Protocol (TCP) Reorder Processing and Retransmission Removal Engine for ordering the assembled packets; and a Protocol Normalization Engine for normalizing the ordered packets; wherein the Fragment Reassembly Engine performs fragment reassembly to accurately classify packets at layer 4 ; and wherein the Fragment Reassembly Engine provides statistics for rate anomalies for fragmented packets and header anomalies for packets with fragmentation related anomalies.