Method and apparatus for automated network-wide surveillance and security breach intervention

Abstract From the Canadian patent

A network surveillance system includes a handler process (10) for capturing network packets and filtering invalid packets a first and second continuously , sorted record file (15a 15b), and a scanner process (30) for scanning all sessions occurring on the network and checking for the presence of certain rules (38). When a rule is met, indicating a security incident a variety of , appropriate actions may be taken including notifying a network security officer via electronic or other mail or recording or terminating a network session. The surveillance system operates completely independently of any other network traffic and the network file server and therefore has no impact on network …