The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Mar. 18, 2014
Filed:
Nov. 18, 2008
David Allen Dennerline, Sandy Springs, GA (US);
Hubertus Franke, Cortlandt Manor, NY (US);
David Paul Lapotin, Austin, TX (US);
Terry Lee Nelms, Ii, Dallas, GA (US);
Hao Yu, Valhalla, NY (US);
David Allen Dennerline, Sandy Springs, GA (US);
Hubertus Franke, Cortlandt Manor, NY (US);
David Paul LaPotin, Austin, TX (US);
Terry Lee Nelms, II, Dallas, GA (US);
Hao Yu, Valhalla, NY (US);
International Business Machines Corporation, Armonk, NY (US);
Abstract
Improved techniques are disclosed for use in an intrusion prevention system or the like. For example, a method comprises the following steps performed by a computing element of a network. A packet of a flow is received, the flow comprising a plurality of packets, wherein the plurality of packets represents data in the network. A network intrusion analysis cost-benefit value is determined representing a benefit for analyzing the received packet for intrusions in relation to a cost for analyzing the received packet for intrusions. The method compares the network intrusion analysis cost-benefit value to a network intrusion analysis cost-benefit threshold to determine whether analyzing the received packet for intrusions before forwarding the received packet is warranted. Responsive to a determination that analyzing the received packet for intrusions before forwarding the received packet is not warranted, the received packet is forwarded, an indication is made that subsequent packets of the flow should be forwarded, and a determination is made whether the received packet indicates an intrusion after forwarding the received packet.