Polymorphic security policy action

An electronic digital network security device having improved security and comprising:

• one or more processors;
• one or more first network interfaces that are configured to couple to a client computer;
• one or more second network interfaces that are coupled to a server computer that the security device is configured to protect from attack;
• one or more non-transitory computer-readable storage media coupled to the one or more processors and storing one or more sequences of instructions which when executed by the one or more processors cause performing:
• receiving one or more messages that are determined as unauthorized;
• obtaining a plurality of state data values from one or more of the security device, the one or more messages, and a second computer;
• before providing the one or more messages to the server computer:
• using pseudo-random selection logic, based on the state data values, pseudo-randomly selecting a particular policy action from among a plurality of different stored policy actions;
• acting upon the one or more messages using the particular policy action;
• wherein the storage media further comprise sequences of instructions which when executed cause performing the pseudo-randomly selecting only from among a subset of the plurality of different policy actions that include a marking specifying polymorphic treatment.

A method of improving the security of a computing device comprising:

• using an electronic digital security device, detecting an attack represented in one or more messages received at the security device;
• before admitting the one or more messages to a network that the security device protects, obtaining one or more first data values relating to then-current state of the security device, and one or more second data values from the one or more messages;
• using a pseudo-random mapping function, pseudo-randomly mapping a combination of the first data values and the second data values to a particular policy action from among a plurality of policy actions;
• applying the particular policy action to the one or more messages;
• wherein the method further comprises performing the pseudo-randomly selecting only from among a subset of the plurality of different policy actions that include a marking specifying polymorphic treatment.