Active network defense system and method

A method for network protection, comprising:

• collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow;
• performing a statistical analysis on the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• terminating at least one session associated with the suspected multi-session attack;
• filtering all packets of remaining sessions in the data flow against a threat criteria for detecting threatening packets, each packet including a header portion and a payload portion, the filtering comprising comparing non-header character strings and/or expression values within the payload portion of the passing packets against the threat criteria which comprises both payload character strings and payload regular expression values that are characteristic of threatening packets;
• allowing non-threatening packets to pass on to a protected network;
• and
• extracting the threatening packets from the data flow.

A method for network protection, comprising:

• monitoring all packets passing in a data flow at line speed for a presence of information indicative of an attack, comprising:
• collecting data concerning a nature of the packets in the data flow across multiple different sessions;
• statistically analyzing the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• checking header field values in the packets for the presence of header content information indicative of dangerous packet traffic;
• and
• checking non-header character strings and/or expression values within a payload of the packets for the presence of certain payload character strings and payload regular expression values which are indicative of dangerous packet traffic;
• blocking those packets associated with the suspected multi-session attack from remaining in the data flow;
• and
• blocking those packets having said information indicative of dangerous packet traffic from entering a protected network.

A method of network protection, comprising:

• collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow;
• performing a statistical analysis on the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• blocking packets associated with the suspected multi-session attack from remaining in the data flow;
• performing a packet payload inspection of all remaining packets to identify packets by comparing non-header character strings and/or expression values within each said packet against payload character strings and payload regular expression values;
• allowing packets in said data flow to pass on to a protected network based on the identification;
• and
• blocking packets from entering said network based on the identification.

A method for network protection, comprising:

• determining whether a multi-session attack exists, comprising:
• collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow;
• performing a statistical analysis on the collected data against an algorithmic filter to identify a suspicion of a multi-session attack;
• performing stateful pattern matching of the packets passing in the data flow, comprising:
• determining whether header field values in passing packets match field values characteristic of suspicious packets;
• and
• determining whether non-header character strings and/or expression values within payloads of said passing packets match character strings and regular expression values characteristic of suspicious packets;
• allowing packets not associated with the suspected multi-session attack and which pass pattern matching analysis to pass on to a protected network;
• blocking packets associated with the suspected multi-session attack or which fail pattern matching analysis from entry into said protected network.

A method for network protection, comprising:

• collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow;
• performing a statistical analysis on the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• performing a deep packet inspection of packets attempting to enter a protected network, wherein each of the packets includes a header portion and a payload portion, and the deep packet inspection compares non-header character strings and/or expression values within the payload portion against certain strings and/or expressions defining payload content-based threat criteria;
• allowing packets which are not associated with a suspected multi-session attack and which pass deep packet inspection to pass on to the protected network;
• and
• blocking packets which either are associated with a suspected multi-session attack or fail deep packet inspection from entry into the protected network.

A method for network protection, comprising:

• collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow;
• statistically analyzing the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• filtering packets against a threat criteria for detecting threatening packets by inspecting packets attempting to enter a protected network, each packet including a header portion and a payload portion, the filtering comprising comparing non-header character strings and/or expression values within the payload portion of all packets against the threat criteria which comprises both payload character strings and payload regular expression values that are characteristic of threatening packets;
• allowing non-threatening packets to pass on to a protected network;
• and
• extracting the threatening packets from the data flow;
• wherein the threat criteria are tailored in response to the suspected existence of a multi-session attack to make the filtering more sensitive to identifying threatening packets associated with the suspected multi-session attack.

A method for network protection, comprising:

• monitoring all packets attempting to enter a protected network at line speed for a presence of information indicative of an attack, comprising;
• collecting data concerning a nature of the monitored packets across multiple different sessions;
• statistically analyzing the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists;
• checking header field values in the monitored packets for the presence of header content information indicative of dangerous packet traffic;
• and
• checking non-header character strings and/or expression values within a payload of the monitored packets for the presence of certain strings and/or expressions defining payload content information indicative of dangerous packet traffic;
• and
• blocking those packets associated with the suspected multi-session attack or having said information indicative of dangerous packet traffic from entering a protected network.