Passive security analysis with inline active security device
AssigneeStealth Security, Inc.
InventorsShreyans Mehta, Ameya Talwalkar
Life of this patent
Estimating the term…
Abstract
Techniques to facilitate network security analysis and attack response are disclosed herein. In at least one implementation, a passive analysis system receives a copy of network traffic, performs deep analysis on the copy of network traffic, and generates security data points based on the deep analysis. The passive analysis system then provides the security data points to an active inline security device, wherein the active inline security device compares incoming network traffic to the security data points to detect security events.
Claims20
A method to facilitate network security analysis and attack response, the method comprising:
- in a passive analysis system:
- receiving a copy of network traffic;
- performing deep analysis on the copy of network traffic;
- generating security data points based on the deep analysis;
- and
- providing the security data points to an active inline security device, wherein the active inline security device compares incoming network traffic to the security data points to detect security events.
One or more computer-readable storage media having program instructions stored thereon to facilitate network security analysis and attack response, wherein the program instructions, when executed by a passive analysis system, direct the passive analysis system to at least:
- receive a copy of network traffic;
- perform deep analysis on the copy of network traffic;
- generate security data points based on the deep analysis;
- and
- provide the security data points to an active inline security device, wherein the active inline security device compares incoming network traffic to the security data points to detect security events.
A network security system comprising:
- a passive analysis system;
- and
- an active inline security device;
- the passive analysis system configured to receive a copy of network traffic, perform deep analysis on the copy of network traffic, generate security data points based on the deep analysis, and provide the security data points to the active inline security device, and
- the active inline security device configured to compare incoming network traffic to the security data points to detect security events.
Dependencies are inferred from the claim text.