Method and system for adaptive network security using intelligent packet analysis
AssigneeCisco Technology, Inc.
InventorsRobert E. Gleichauf, Daniel M. Teal, Kevin L. Wiley
Life of this patent
Estimating the term…
Abstract
A method and system for adaptive network security using intelligent packet analysis are provided. The method comprises monitoring network data traffic. The network data traffic is analyzed to assess network information. A plurality of analysis tasks are prioritized based upon the network information. The analysis tasks are to be performed on the monitored network data traffic in order to identify attacks upon the network.
Claims54
A computer implemented method for adaptive network security using intelligent packet analysis, comprising:
- monitoring network data traffic;
- analyzing the network data traffic to assess network information;
- prioritizing a plurality of analysis tasks based upon the network information, the analysis tasks to be performed on the monitored network data traffic in order to identify attacks upon the network;
- wherein the plurality of analysis tasks includes a plurality of comparisons between the monitored network data traffic and a plurality of attack signatures;
- and
- disabling a particular attack signature based upon an assigned priority of the particular attack signature.
A computer method for adaptive network security using intelligent packet analysis, comprising:
- monitoring network data traffic;
- analyzing the network data traffic to assess network information;
- prioritizing a plurality of protocol analyses to be performed on monitored traffic from the network, the protocol analyses for identifying attacks upon the network;
- monitoring a processor utilization;
- monitoring memory utilization;
- disabling a particular protocol analysis based upon an assigned priority if the processor utilization exceeds a first defined threshold;
- and
- disabling a particular protocol analysis based upon an assigned priority if the memory utilization exceeds a third defined threshold.
A computer implemented method for adaptive network security using intelligent packet analysis, comprising:
- monitoring network data traffic;
- analyzing the network data traffic to assess network information;
- prioritizing a plurality of comparisons between monitored network data traffic and a plurality attack signatures based upon the network information, the attack signatures for identifying attacks upon the network;
- monitoring a processor utilization;
- monitoring memory utilization;
- disabling a particular attack signature based upon an assigned priority if the processor utilization exceeds a first defined threshold;
- and
- disabling a particular attack signature based upon an assigned priority if the memory utilization exceeds a third defined threshold.
A system for adaptive network security using intelligent packet analysis, comprising:
- an analysis engine coupled to a network, the analysis engine for analyzing network data traffic to assess network information;
- a protocol engine coupled to the network, the protocol engine for performing a plurality of protocol analyses on the network data traffic to identify attacks upon the network;
- a signature engine coupled to the network, the signature engine for comparing the network data traffic to a plurality of attack signatures to identify attacks upon the network;
- and
- a priority engine coupled to the analysis engine, the protocol engine, and the signature engine, the priority engine for prioritizing the plurality of protocol analyses and the plurality of attack signatures based upon the network information.
Dependencies are inferred from the claim text.