Patent ID: 7725936

Claim:
A method of detecting an intrusion in a communications network, the method comprising the steps of: a) accessing, by a network intrusion detection process of a target computer system, communication to an application receive queue (ARQ) for an application running in an application layer of the target computer system, wherein the ARQ functions intermediate the application layer and a transport layer of a network protocol associated with said communications network to receive data packets for the application from the transport layer; b) scanning for the application by the network intrusion detection process only the data packets accessed by the network intrusion detection process in a), wherein the data packets are directed to the application from a remote host via the communications network, and wherein the scanning is after the data packets have been processed by the transport layer and after the transport layer has passed the processed data packets for receipt by the application's ARQ; c) determining if said scanned data packets are malicious; and d) taking at least one action to prevent the application from processing data packets from the remote host to the application responsive to c) determining that any of the scanned data packets are malicious.