Method and system for prioritizing security operations in a communication network

• US 20060253902A1
• Filed: 05/05/2005
• Published: 11/09/2006
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sankar, Swaminathan, Guillem, Jordi Juan, Rabadan, Carlos Lopez
• Granted Patent: US 7,765,591 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method, system and apparatus for filtering data packets through an integrated network security device are provided. Various security operations are performed on the data packets belonging to a network connection while they pass through the integrated network security device in a communication network. A classification engine is applied to the first packet of the connection. The result of this filtering is stored in a per-connection control key, and determines which of the security operations must be applied to each of the data packets of the connection. These security operations may be prioritized and re-ordered, based on the rate at which they detect and drop malicious data packets.

Claims

1. A method for filtering data packets through a network security device, the method comprising

performing a plurality of security operations on each of the data packets, the plurality of security operations including dropping of malicious data packets;

recording rate of the malicious data packets being dropped by each of the plurality of security operation; and

re-ordering the plurality of security operations, the re-ordering being based on the rate of the data packets being dropped by the plurality of security operations, wherein the plurality of security operations are re-ordered automatically.

2. The method of claim 1, wherein the each of the plurality of security operations are periodically re-ordered.

3. The method of claim 1, wherein the each of the plurality of security operations is re-ordered based on the changes in the rates of the malicious data packets being dropped.

4. The method of claim 1, wherein a pattern of the malicious data packets being dropped by the each of the plurality of security operations is recorded.

5. The method of claim 1, wherein the re-ordering of the plurality of security operations comprises determining the most effective security operations amongst the plurality of security operations, the most effective security operation being able to detect and drop the malicious data packets.

6. A system for filtering data packets through a network security device, the system comprising

means for performing a plurality of security operations on each of the data packets;

means for recording rate of malicious data packets being dropped by each of the plurality of security operation; and

means for re-ordering the plurality of security operations, the re-ordering being based on the rate of the malicious data packets being dropped by the plurality of security operations, wherein the plurality of security operations are re-ordered automatically.

7. A system for filtering data packets through a network security device, the system comprising

one or more security operations module, the one or more security operations module performing a plurality of security operations on each of the data packets;

a recording module for recording rate of malicious data packets being dropped by each of the plurality of security operations module; and

a re-ordering module for automatically re-ordering the plurality of security operations.

8. The system of claim 7 further comprising a connection-object being associated with each network connection.

9. The system of claim 7 further comprising a control key providing the plurality of security operations to be applied on the data packets.

10. The system of claim 7, wherein the network security device comprises an integrated network security device.

11. An apparatus for filtering data packets through a network security device, the apparatus comprising

a processing system including a processor coupled to a display and user input device;

a machine-readable medium including instructions executable by the processor comprising

one or more instructions for performing a plurality of security operations on each of the data packets, the plurality of security operations including dropping of malicious data packets;

one or more instructions for recording rate of the malicious data packets being dropped by each of the plurality of security operation; and

one or more instructions for re-ordering the plurality of security operations, the re-ordering being based on the rate of the malicious data packets being dropped by the plurality of security operations, wherein the plurality of security operations are re-ordered automatically.

12. A machine-readable medium including instructions for filtering data packets through a network security device, the instructions being executable by a processor comprising

one or more instructions for performing a plurality of security operations on each of the data packets, the plurality of security operations including dropping of malicious data packets;

one or more instructions for recording rate of the malicious data packets being dropped by each of the plurality of security operation; and

one or more instructions for re-ordering the plurality of security operations, the re-ordering being based on the rate of the malicious data packets being dropped by the plurality of security operations, wherein the plurality of security operations are re-ordered automatically.