System and Method for Building Intelligent and Distributed L2 - L7 Unified Threat Management Infrastructure for IPv4 and IPv6 Environments

A security gateway, comprising:

• a memory and a processing unit communicatively coupled to the memory wherein the memory stores computer-executable instructions which, when executed by the processing unit, cause the processing unit to evaluate network traffic received at the security gateway according to a dynamic real time rating scheme that facilitates categorization of content represented in the traffic and, based on results of the dynamic real time rating apply a determined level of anti-virus, anti-malware scanning to the traffic.

A security gateway, comprising:

• a memory and a processing unit communicatively coupled to the memory wherein the memory stores computer-executable instructions which, when executed by the processing unit, cause the processing unit to log user access histories within a network associated with the security gateway and, according to analyses of said logged user access histories, apply determined levels of data loss prevention scrutiny to traffic associated with recognized users.

A security gateway, comprising a processing unit and a non-transitory storage device communicatively coupled to the processing unit, said non-transitory storage device storing computer-executable instructions which, when executed by said processing unit, provide the security gateway with a policy engine configured to inform a traffic classification engine that evaluates network traffic received at said security gateway to handle traffic in accordance with policies written at an application level and expressed in natural language by passing traffic to appropriate application proxies and to update, dynamically, an L2-L4 firewall engine in accordance with new traffic classifications based on extended observations of the network traffic which result in updated classification decisions.

A cluster of security gateways, comprising a plurality of security gateway appliances communicatively coupled to one another in a full mesh configuration, each configured to evaluate network traffic according to security rules that classify traffic flows according to specifically identified application programs responsible for producing and/or consuming the network traffic and to enforce policies in accordance with network traffic classifications.

A method, comprising establishing a peering relationship among two or more security gateway appliances so as to define a cluster of peered security gateway appliances, each security gateway appliance of the cluster exchanging traffic flow information describing actions to be taken with respect to network traffic of the traffic flows received at the member network security gateway appliances of the clusters.

A system, comprising a network security gateway appliance associated with an enterprise or other network and communicatively coupled to a cluster of security gateway appliances instantiated as a cloud-based service, wherein said cluster of security gateway appliances is configured to provide specified services to said enterprise or other network via said security gateway appliance, said services comprising some or all of data loss protection, anti-virus/anti-malware scanning and policy enforcement, dynamic real time rating of content sources, security services, network acceleration, and other policy based services.

A system, comprising a plurality of security gateway appliances, each deployed within or associated with individual networks or segments thereof and configured to act as intrusion detection sensors for their respective networks or segments, each security gateway appliance communicatively coupled to a central security gateway controller that is configured to compute an overall threat map for the system and, based on the overall threat map to determine a set of active defenses for the system and deploy to each of the plurality of security gateway appliances a set of dynamic polices to implement the set of active defenses.