Retrieving network packets corresponding to detected abnormal application activity
AssigneeInternational Business Machines Corporation
InventorsKuo-Chun Chen, Chih-Hung Chou, Wei-Hsiang Hsiung, Sheng-Tung Hsu
Life of this patent
Estimating the term…
Abstract
A method for preventing abnormal application activity is provided. Packets are retrieved from a packet buffer using packet location information corresponding to information associated with the abnormal application activity in a data processing system. The packets are analyzed to identify content of the network packets causing the abnormal application activity. Network packets containing the content causing the abnormal application activity in the data processing system are blocked.
Claims22
A computer-implemented method for preventing abnormal application activity associated with a software application running on a data processing system, the computer-implemented method comprising:
- retrieving, by the data processing system, packets from a packet buffer in response to detecting the abnormal application activity using packet location information corresponding to information associated with the detected abnormal application activity running on the data processing system, wherein the packet location information is used to map a relationship between a received packet and the software application associated with the detected abnormal activity causing security violation;
- analyzing, by the data processing system, the packets to identify content of the packets causing the abnormal application activity;
- and
- blocking, by the data processing system, network packets containing the content causing the abnormal application activity in the data processing system.
Dependencies are inferred from the claim text.