08171553 is referenced by 151 patents and cites 138 patents.

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Title
Heuristic based capture with replay to virtual machine
Application Number
11/409355
Publication Number
8171553 (B2)
Application Date
April 20, 2006
Publication Date
May 1, 2012
Inventor
Muhammad Amin
Menlo Park
CA, US
Jayaraman Manni
Menlo Park
CA, US
Ramesh Radhakrishnan
Menlo Park
CA, US
Adrian Drzewiecki
Menlo Park
CA, US
Ashar Aziz
Menlo Park
CA, US
Agent
Carr & Ferrell
Assignee
FireEye
CA, US
IPC
G06F 12/14
G06F 11/30
View Original Source