Integrated network intrusion detection

A machine-implemented method comprising:

• identifying an invoked application;
• receiving requests for network communication services from the invoked application;
• selectively designating each of the received requests as authorized or unauthorized based on an application-specific network policy;
• blocking inbound network communications that fail to correspond to an authorized request;
• monitoring the blocked inbound network communications to detect an intrusion;
• and
• initiating monitoring of network communications for the invoked application using an application-specific intrusion signature in response to one or more unauthorized requests.

A system comprising:

• an application network policy enforcer, which services network requests from an application invoked on a machine, identifies the network requests that fail to satisfy an application-specific network policy, and identifies the network requests that satisfy the application-specific network policy;
• a network traffic enforcer, which blocks inbound network traffic that does not correspond to the network requests identified by the application network policy enforcer as satisfying the application-specific network policy;
• and
• an intrusion detector, which responds to the network requests identified by the application network policy enforcer as failing to satisfy the application-specific network policy, and which responds to the inbound network traffic blocked by the network traffic enforcer.

A system comprising:

• means for servicing network requests from an application invoked on a machine;
• means for authorizing the network requests using an application-specific network policy;
• means for blocking traffic that does not correspond to an authorized request;
• means for monitoring blocked traffic to identify an intrusion prelude and to identify abnormal application behavior;
• means for detecting an intrusion in response to an identified intrusion prelude;
• and
• means for detecting an intrusion in response to identified abnormal application behavior.

A machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising:

• identifying an invoked application;
• receiving requests for network communication services from the invoked application;
• selectively designating each of the received requests as authorized or unauthorized based on an application-specific network policy;
• blocking inbound network communications that fail to correspond to an authorized request;
• monitoring the blocked inbound network communications to detect an intrusion;
• and
• initiating monitoring of network communications for the invoked application using an application-specific intrusion signature in response to one or more unauthorized requests.

A machine-implemented method comprising:

• blocking inbound network communications that fail to correspond to a network policy;
• detecting a potential intrusion prelude from the blocked inbound network communications;
• selectively generating a fabricated response to the detected potential intrusion prelude;
• and
• receiving information about a potential intruder in response to the generated fabricated response.