Active network defense system and method

#The present application is related to co-pending U.S. application for patent Ser. No. 10/136,889, filed Apr. 30, 2002, entitled NETWORK SECURITY SYSTEM INTEGRATION, the disclosure of which is hereby incorporated by reference.

#The present application is related to co-pending U.S. application for patent Ser. No. 10/217,862, filed Aug. 12, 2002, entitled MULTI-LEVEL PACKET SCREENING WITH DYNAMICALLY SELECTED FILTERING CRITERIA, the disclosure of which is hereby incorporated by reference.

#1. Technical Field of the Invention

#A more complete understanding of the method and apparatus of the present invention may be acquired by reference to the following Detailed Description when taken in conjunction with the accompanying Drawings wherein:

#FIG. 1 is a block diagram of an active network defense system in accordance with the present invention; and

#FIG. 2 is a more detailed block diagram of the system of FIG. 1.

#The present invention provides an active network defense system that is operable to monitor and block traffic in an automated fashion. This active network defense system is preferably placed in-line (i.e., in the packet traffic data flow) as a part of the network infrastructure to inspect and possibly manipulate every passing packet. This network defense solution constitutes a dramatic technology shift away from the passive intrusion detection systems of the prior art.

#Importantly, the active network defense system must be capable of performing reliably at line speeds. When it detects a malicious packet, action is immediately taken to drop that packet and thus prevent its entrance into the network where damage could be done. Thus, with the dropping of the packet, the attack is immediately blocked, with the added benefits that no damage needs to be repaired and no alarms need to be processed.

#The active network defense system provides some further advantages. Beyond blocking, the active network defense system possesses the ability to modify packets. One packet modification concept of some importance is the notion of normalization. Normalization is the process of enforcing adherence to a particular implementation of a protocol or standard. For example, a popular intrusion detection system evasion technique exploits the variation in the ways target systems handle fragmentation. Some systems reassemble overlapping fragments with the first overlapping packet's data, others reassemble with the last packet's data. An intrusion detection system needs to guess at how the target may reassemble or consider all options. By failing to predict how the target will behave, attacks may either go undetected or false alarms be generated. In contrast, by sitting in-line and intercepting all packets, the active network defense system of the present invention can perform normalization by reassembling fragments using a set algorithm and forwarding reassembled packets. Normalizing the flow eliminates the need to guess at how a packet or flow will be handled on different target systems and thwarts popular detection evasion techniques.