UNIFIED NETWORK THREAT MANAGEMENT WITH RULE CLASSIFICATION

• US 20090222877A1
• Filed: 02/28/2008
• Published: 09/03/2009
• Est. Priority Date: 02/28/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Green, Michael W., Venugopalan, Ramnath, Markovic, Stevan, Diehl, David
• Granted Patent: US 8,561,129 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A computer network device comprises an intrusion prevention rule set comprising a plurality of rules, each of the plurality of rules associated with two or more rule classification parameters, and an intrusion prevention module that is operable to use two or more of the classification parameters associated with the plurality of intrusion protection rules to selectively apply the rules to provide network intrusion protection of network traffic

Claims

1. A computer network device, comprising:

an intrusion prevention rule set comprising a plurality of rules, each of the plurality of rules associated with two or more rule classification parameters;

an intrusion prevention module operable to use two or more of the classification parameters associated with the plurality of intrusion protection rules to selectively apply the rules to provide network intrusion protection of network traffic.

2. The computer network device of claim 1, wherein the rule classification parameters comprise at least one of a signature category, response type, and an attack type.

3. The computer network device of claim 2, wherein the signature category is used to limit rule processing to relevant signatures.

4. The computer network device of claim 2, wherein the response type determines the action taken for network traffic that violates an applicable rule.

5. The computer network device of claim 2, wherein the device is operable to automatically apply rule updates based on at least one of rule classification parameters and rule configuration parameters.

6. The computer network device of claim 1, further comprising a firewall module operable to use two or more firewall rules to provide firewall filtering of network traffic.

7. The computer network device of claim 6, wherein the intrusion prevention rules are associated with specific firewall rules, such that only relevant intrusion protection rules are applied to specific network traffic identified via the firewall.

8. The computer network device of claim 1, further comprising a packet processing module operable to receive network packets and recreate network packets derived from the data encoded in the received network packets.

9. A computer network device, comprising:

an intrusion prevention rule set comprising a plurality of rules, each of the plurality of rules associated with at least one classification parameter, wherein the classification parameter comprises a rule type of the associated rule; and

an intrusion prevention module operable to use the classification parameters associated with the plurality of intrusion protection rules to provide network intrusion protection of network traffic.

10. The computer network device of claim 9, wherein each of the plurality of rules of an intrusion prevention rule set is further a member of a rule group that is associated with a response type to be applied in the event of violation of a rule within the rule group.

11. A method of operating a computer network device, comprising:

maintaining an intrusion prevention rule set comprising a plurality of rules, each of the plurality of rules associated with two or more rule classification parameters;

using two or more of the classification parameters associated with the plurality of intrusion protection rules to selectively apply the rules via an intrusion prevention module to provide network intrusion protection of network traffic.

12. The method of operating a computer network device of claim 11, wherein the rule classification parameters comprise at least one of a signature category, response type, and an attack type.

13. The method of operating a computer network device of claim 12, wherein the signature category is used to limit rule processing to relevant signatures.

14. The method of operating a computer network device of claim 12, wherein the action taken for network traffic that violates an applicable rule is determined by the response type.

15. The method of operating a computer network device of claim 12, further comprising automatically applying rule updates based on at least one of rule classification parameters and rule configuration parameters.

16. The method of operating a computer network device of claim 11, further comprising a firewall module operable to use two or more firewall rules to provide firewall filtering of network traffic.

17. The method of operating a computer network device of claim 16, wherein the intrusion prevention rules are associated with specific firewall rules, such that only relevant intrusion protection rules are applied to specific network traffic identified via the firewall.

18. The method of operating a computer network device of claim 11, further comprising a packet processing module operable to receive network packets and recreate network packets derived from the data encoded in the received network packets.

19. A method of operating a computer network device, comprising:

providing an intrusion prevention rule set comprising a plurality of rules, each of the plurality of rules associated with at least one classification parameter, wherein the classification parameter comprises a rule type of the associated rule; and

using the classification parameters associated with the plurality of intrusion protection rules to provide network intrusion protection of network traffic.

20. The method of operating a computer network device of claim 19, wherein each of the plurality of rules of an intrusion prevention rule set is further associated with a response type that is applied in the event of a rule violation.