Patent Document ID: 7626940
Application ID: 11158317
Patent Status: 1

Claim One:
1. An apparatus for enforcing network policies and preventing attacks related to header, state, rate and content anomalies, wherein the attacks include Domain Name Service (DNS) attacks, said apparatus comprising: a) a Packet Interface that is programmed for receiving inbound/outbound packets, storing the packets in a memory buffer, releasing the packet with a packet-id to subsequent blocks for inspection, dropping the packets altogether, and sending the packets onto forensic ports based on a unified decision; b) a Classifier that comprises a DNS Classifier, that is coupled to the Packet Interface, and that is programmed for classifying packets received from the Packet Interface and retrieving layer 2, layer 3, layer 4, and layer 7 header information from the packets; c) a Header and State Anomaly Prevention Engine that comprises a DNS State Anomaly Engine, that is coupled to the Classifier via a classification bus, and that is programmed for determining layers 2, 3, 4, and 7 header and state anomalies; d) a Continuous and Adaptive Rate Anomaly Prevention Engine that comprises a DNS Rate Anomaly Engine, that is coupled to the classification bus, and that is programmed for determining and estimating rate thresholds for layers 2, 3, 4, and 7 parameters and subsequently determining rate anomalies for these parameters; e) a Recon Prevention Engine that is coupled to the classification bus and programmed for determining recon activities at layers 3 and 4; f) a Content Anomaly Engine that comprises a DNS Content Anomaly Engine, that is coupled to the classification bus, and that is programmed for determining known attacks using signatures including on Domain Name Service; g) a Policy Lookup Engine that comprises a DNS Policy Engine, that is coupled to the classification bus, and that is programmed for determining policy violation in packets; and h) a Decision Multiplexer for generating the unified decision about a packet-id based on information received from a plurality of sources including the Header and State Anomaly Prevention Engine, the Continuous and Adaptive Rate Anomaly Prevention Engine, the Recon Prevention Engine, the Content Anomaly Engine, and the Policy Lookup Engine.