Method and system for prioritizing security operations in a communication network

• US 7,765,591 B2
• Filed: 05/05/2005
• Issued: 07/27/2010
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Guillem, Jordi Juan, Rabadan, Carlos Lopez, Sankar, Swaminathan
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H
• Application Number:
  US11/123,661
• Publication Number:
  US 20060253902A1
• Time in Patent Office: 1,909 Days
• Field of Search: 726/13
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method, system and apparatus for filtering data packets through an integrated network security device are provided. Various security operations are performed on the data packets belonging to a network connection while they pass through the integrated network security device in a communication network. A classification engine is applied to the first packet of the connection. The result of this filtering is stored in a per-connection control key, and determines which of the security operations must be applied to each of the data packets of the connection. These security operations may be prioritized and re-ordered, based on the rate at which they detect and drop malicious data packets.

Claims

1. A method comprising:

performing a plurality of different security operations on each of a plurality of data packets at a single network security device, the plurality of security operations including dropping of malicious data packets;

recording a rate of malicious data packets being dropped by each of the plurality of security operations;

associating a priority to each security operation based on a rate of malicious data packets being dropped such that a given security operation having a higher rate of malicious data packets being dropped has a higher priority than a given security operation having a lower rate of malicious data packets being dropped; and

re-ordering the plurality of security operations at the network security device, the re-ordering being based on a decreasing order of priority, wherein the plurality of security operations are re-ordered automatically.

2. The method of claim 1, wherein the results of the re-ordering are stored in a per-connection control key, and wherein the re-ordering is applied to data packets of a particular connection.

3. The method of claim 1, wherein security operations are re-ordered periodically, and a time period for periodically re-ordering the operations is based on the changes in the rates of the malicious data packets being dropped.

4. The method of claim 1, wherein a pattern of the malicious data packets being dropped by the each of the plurality of security operations is recorded.

5. The method of claim 1, wherein the re-ordering of the plurality of security operations comprises determining the most effective security operations amongst the plurality of security operations, the most effective security operation being able to detect and drop the malicious data packets.

6. A system comprising:

means for performing a plurality of different security operations on each of a plurality of data packets at a single network security device;

means for recording a rate of malicious data packets being dropped by each of the plurality of security operations;

means for associating a priority to each security operation based on a rate of malicious data packets being dropped such that a given security operation having a higher rate of malicious data packets being dropped has a higher priority than a given security operation having a lower rate of malicious data packets being dropped; and

means for re-ordering the plurality of security operations at the single network security device, the re-ordering being based on a decreasing order of priority, wherein the plurality of security operations are re-ordered automatically.

7. A system comprising:

one or more security operations modules, the one or more security operations module performing a plurality of different security operations on each of a plurality of data packets at a single network security device;

a recording module for recording a rate of malicious data packets being dropped by each of the plurality of security operations module; and

a re-ordering module for automatically re-ordering the plurality of security operations at the single network security device, the re-ordering being based on a decreasing order of priority, wherein each security operation is associated with a rate of malicious data packets being dropped such that a given security operation having a higher rate of malicious data packets being dropped has a higher priority than a given security operation having a lower rate of malicious data packets being dropped.

8. The system of claim 7 further comprising a connection-object being associated with each network connection.

9. The system of claim 7 further comprising a control key providing the plurality of security operations to be applied on the data packets.

10. The system of claim 7, wherein the network security device comprises an integrated network security device.

11. An apparatus comprising:

a processing system including a processor coupled to a display and user input device;

a machine-readable medium including instructions executable by the processor comprising;

one or more instructions for performing a plurality of different security operations on each of a plurality of data packets at a single network security device, the plurality of security operations including dropping of malicious data packets;

one or more instructions for recording a rate of the malicious data packets being dropped by each of the plurality of security operations;

one or more instructions for associating a priority to each security operation based on a rate of malicious data packets being dropped such that a given security operation having a higher rate of malicious data packets being dropped has a higher priority than a given security operation having a lower rate of malicious data packets being dropped; and

one or more instructions for re-ordering the plurality of security operations at a single network security device, the re-ordering being based on a decreasing order of priority, wherein the plurality of security operations are re-ordered automatically.

12. A non-transitory machine-readable medium including instructions executable by a processor, the machine-readable medium comprising:

one or more instructions for performing a plurality of different security operations on each of a plurality of data packets at a single network security device, the plurality of security operations including dropping of malicious data packets;

one or more instructions for recording a rate of the malicious data packets being dropped by each of the plurality of security operations;

one or more instructions for associating a priority to each security operation based on a rate of malicious data packets being dropped such that a given security operation having a higher rate of malicious data packets being dropped has a higher priority than a given security operation having a lower rate of malicious data packets being dropped; and

one or more instructions for re-ordering the plurality of security operations at a single network security device, the re-ordering being based on a decreasing order of priority, wherein the plurality of security operations are re-ordered automatically.