Multi-level packet screening with dynamically selected filtering criteria

Abstract

A packet filtering operation implements a hierarchical technique. Received packet traffic is first filtered with a first filtering criteria. This first filtering action generates a first pass traffic portion and a fail traffic portion from the received packet traffic. The fail traffic portion is then second filtered with a second filtering criteria. This second filtering action generates a second pass traffic portion and a reject traffic portion. The first filtering criteria provide for higher throughput, lower accuracy processing while the second filtering criteria provide for lower throughput, higher accuracy processing. Dynamic adjustments may be made to the first and second filtering criteria to achieve better overall packet filtering performance. For example, load is measured and the filtering criteria adjusted to better balance load between the hierarchical filtering actions.

Description

technical field [0001] The present invention relates to multi-level screening of information packet communication, in particular to a hierarchical screening technology, wherein the filtering criteria of each level can be dynamically adjusted based on, for example, the processing capability of each level and / or the change of information packet traffic choose. Background technique [0002] Filtering of packet traffic is required in many well-recognized situations. One such situation is where a network intrusion detection system (IDS) is employed, requiring inspection of passing packet communications for threatening or dangerous content. When such a threat is detected, the suspicious packet traffic is identified and either captured or dropped (perhaps using a firewall) before it has a chance to enter a protected network. [0003] As is well known, inspection and screening operations on packet traffic are time consuming and thus may cause delays in packet traffic throughput. ...

AI Technical Summary

Problems solved by technology

[0003] inspection and screening of packet traffic is known to be time consuming and thus may cause delays in packet traffic throughput

This delay is especially pronounced when the amount of traffic to be inspected increases and the intrusion detection system bottlenecks the throughput of packet traffic

If a more comprehensive (and more time-consuming) screening operation is used, it may cause further delays in the passage time

Images