Network attack offensive appliance

1. A system that enables launching a cyber-offensive countermeasure on a network, the system comprising:

a memory,

multiple processors, at least one of the multiple processors being configured to enable the system to:

receive packets routed on the network and analyze the received packets to detect an attack directed toward a device on the network when the attack is external to the device,

divide the received packets into at least a first thread associated with a first one of the multiple processors and a second thread associated with a second one of the multiple processors,

edit the received packets, and

transmit the edited packets on the network, wherein

the first one of the multiple processors is associated with a database of filters used to analyze the packets and the database of filters is not shared by the second one of the multiple processors.

2. The system of claim 1 , wherein at least one of the multiple processors is configured to enable the system to edit packet content to suppress an attack detected by the receiving section.

3. The system of claim 2 , wherein at least one of the multiple processors is configured to enable the system to collect the packets, deconstruct the packets, and reconstruct the packets before editing packet content.

4. The system of claim 2 , wherein at least one of the multiple processors is configured to enable the system to, after editing packet content, further edit packet content so that the editing of packet content is not recognizable by the network.

5. The system of claim 4 , wherein at least one of the multiple processors is configured to enable the system to further edit packet content by reordering transmission control protocol (TCP) sequence numbers and checksums.

6. The system of claim 1 , wherein at least one of the multiple processors is configured to enable the system to capture the packets at full payloads at line rate in real time.

7. A system that enables launching a cyber-offensive countermeasure on a network, the system comprising:

a memory,

multiple processors, at least one of the multiple processors being configured to enable the system to:

receive packets routed on the network and analyze the received packets to detect an attack directed toward a device on the network when the attack is external to the device,

divide the received packets into at least a first thread associated with a first one of the multiple processors and a second thread associated with a second one of the multiple processors,

edit the received packets, and

transmit the edited packets on the network, wherein

the first one of the multiple processors is associated with a database of filters used to analyze the packets and the database of filters is not shared by the second one of the multiple processors, and wherein

when the system detects an attack, the system attributes the attack to a source and triggers a countermeasure to suppress the attack, and the counter-measure comprises at least one of slowing the source, watching the source over time, or stopping the source.

8. The system of claim 7 , wherein the countermeasure comprises at least one of flow termination, jamming, botnet capture, disinformation, DNS request capture, rewriting of DNS request to reroute traffic away from an identified botnet, or taking control of a botnet threat to turn it into an attacker to a source botnet controller.

9. The system of claim 1 , wherein the system is deployed independently or as a cluster on the network.

10. A method of providing a cyber-offensive countermeasure on a network, implemented on a computer-readable medium on a server connected to the network, the method comprising:

capturing packets routed on the network,

dividing the received packets into at least a first thread associated with a first processor and a second thread associated with a second processor,

analyzing the captured packets to detect an attack directed toward a device on the network when the attack is external to the device,

editing the captured packets, and

transmitting the edited packets on the network, wherein

the first processor is associated with a database of filters used to analyze the packets and the database of filters is not shared by the second processor.

11. The method of claim 10 , comprising editing packet content to suppress an attack.

12. The method of claim 11 , comprising deconstructing packet content and reconstructing patent content before editing packet content.

13. The method of claim 11 , comprising further editing packet content so that the editing of packet content is not recognizable by the network.

14. The method of claim 13 , comprising further editing of packet content by reordering the transmission control protocol (TCP) sequence numbers and checksums.

15. The method of claim 10 , wherein the method is implemented on a cluster of devices on the network.

16. A cyber-offensive security system that enables a network platform to launch a cyber-offensive countermeasure, the system comprising multiple processors, at least one of the multiple processors being configured to enable the system to:

receive packets routed on the network and analyze the received packets to detect an attack directed toward a device on the network when the attack is external to the device,

divide the received packets into at least a first thread associated with a first one of the multiple processors and a second thread associated with a second one of the multiple processors,

edit the received packets, and

transmit the edited packets on the network, wherein

the first one of the multiple processors is associated with a database of filters used to analyze the packets and the database of filters is not shared by the second one of the multiple processors.