Method for obtaining data for intrusion detection
AssigneeInventec Corporation
InventorsYan LI, Gui-Dong Liu, Tom Chen
Life of this patent
Estimating the term…
Abstract
A method for obtaining data for intrusion detection obtains data after forward chain filtering of a firewall. Modes of obtaining the data include a socket communication mode and a character device work mode. The method for obtaining the data for intrusion detection obtains the data filtered by the firewall, and reduces false alarms. Moreover, the method obtains the data after a network address translation (NAT) operation, so as to locate an attacker and a victim correctly. The method further obtains a decrypted Internet Protocol Security (IPsec) data packet, so as to process an IPsec data stream normally.
Claims6
A method for obtaining data for intrusion detection, for obtaining the data for the intrusion detection in an architecture comprising a firewall and an intrusion detection system, comprising:
- registering a data obtaining point in a forward chain filtering module of the firewall;
- and
- obtaining the data for the intrusion detection at the data obtaining point after forward chain filtering.
Dependencies are inferred from the claim text.