System and method for securing a network from zero-day vulnerability exploits

1. A method of securing a network from vulnerability exploits, comprising:

receiving a plurality of packets destined for an internal operating system;

comparing, by a processor, packets received to at least one signature defined in an intrusion prevention system;

upon a determination that a packet being compared does not match any signature in said intrusion prevention system, storing the packet in a buffer, the buffer providing storage for a plurality of packets;

forwarding a copy of the packet to a virtual machine emulating said internal operating system in processing the packet;

monitoring performance of the virtual machine;

deleting the stored packet from the buffer upon a determination that the stored packet was stored in the buffer for a predetermined time period;

detecting a failure of the virtual machine;

analyzing the packets in the buffer to identify a malicious packet in response to detecting the failure of the virtual machine; and

creating a new signature based upon the identified malicious packet.

2. The method of claim 1 further comprising:

adding said new signature to said intrusion prevention system.

3. The method of claim 1 further comprising:

recording execution of at least one of said receiving, said comparing, said forwarding, said processing, said identifying, and said creating in a memory.

4. A method of securing a network from vulnerability exploits, comprising:

receiving a plurality of packets destined for an internal operating system;

storing each packet of the plurality of packets in a buffer;

selectively forwarding a copy of each packet of said plurality of packets to a virtual machine emulating said internal operating system;

monitoring performance of said virtual machine in processing the forwarded packets;

deleting a stored packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;

detecting a failure of said virtual machine;

analyzing said packets in said buffer and identifying a malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and

creating a malicious packet signature based upon the identified malicious packet.

5. The method of claim 4 further comprising:

sending, by said virtual machine, a status report to said processor through a private network connection linking said virtual machine to said processor.

6. The method of claim 4 further comprising:

identifying at least one non-malicious packet; and

deleting each said non-malicious packet from said buffer.

7. The method of claim 4 further comprising:

recording execution of at least one of said defining, said storing, said deleting, said monitoring, and said analyzing in a memory.

8. The method of claim 1 further comprising:

upon a determination that said packet being compared does match any said signature, preventing said packet from being sent to said internal operating system.

9. The method of claim 1 further comprising:

sending at least one of said signatures in said intrusion prevention system to said internal operating system.

10. The method of claim 1 further comprising:

creating an access control list within said traffic analysis engine specifying packets not to be processed using said virtual machine.

11. A non-transitory machine-readable medium comprising machine readable instructions that when executed by a processor perform a method, the machine readable instructions to cause the processor to:

receive a plurality of packets destined for an internal operating system;

store the plurality of packets in a buffer;

forward a copy of each packet of said plurality of packets to a virtual machine emulating said internal operating system;

monitor performance of said virtual machine in processing the forwarded packets;

delete a packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;

detect a failure of said virtual machine; and

analyze said packets in said buffer and identify said malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and

create a malicious packet signature based upon the identified malicious packet.

12. The non-transitory machine readable medium of claim 11 , wherein the machine readable instructions further comprise code to:

add said identified malicious packet signature to an intrusion prevention system.

13. A system for securing a network from vulnerability exploits, comprising:

a traffic analysis engine, the traffic analysis engine further comprising a processor and a non-transitory computer-readable medium, the non-transitory computer readable medium comprising code, which when executed by the processor, cause the traffic analysis engine to:

receive a plurality of packets destined for an internal operating system;

store each packet of the plurality of packets in a buffer;

selectively forward a copy of each said packet to a virtual machine emulating said internal operating system;

monitor performance of said virtual machine in processing the selectively forwarded packets;

delete a packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;

detect a failure of said virtual machine; and

analyze said packets in said buffer and identify said malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and

create a malicious packet signature based upon the identified malicious packet.

14. The system of claim 13 further comprising:

an incoming network card to provide communication between said system and an external source; and

an outgoing network card to provide communication between said system and said internal operating system.

15. A method of securing a network from vulnerability exploits, comprising:

analyzing packets destined for an internal operating system and discarding any packets having a signature indicating a vulnerability exploit;

storing each packet of the packets in a buffer;

selectively forwarding a copy of each of the packets that do not have a signature indicating a vulnerability exploit to a virtual machine emulating said internal operating system;

monitoring performance of the virtual machine in processing the selectively forwarded packets;

deleting a stored packet from the buffer upon a determination that the stored packet was stored in the buffer for a predetermined time period;

detecting a failure of the virtual machine; and

analyzing the packets in the buffer and identifying a malicious packet from said buffer packets in response to a detected failure of the virtual machine; and

creating a new signature based on the identified malicious packet.