Device, system and method for defending a computer network

1. A non-transitory, processor-readable medium comprising code representing instructions to cause a processor to perform a method comprising:

receiving, from a traffic filter at a boundary of a network, a network communication;

determining which the network communication is, from among being a first anomalous communication associated with a service that does not exist within the network, using a non-readable character set, or including a malicious payload;

defining a fingerprint, based on an order of a plurality of tokens of a network protocol included in the first anomalous communication;

at least partially based on the determining, generating a first rule, at least partially based on an analysis of the fingerprint; and

communicating, to the traffic filter, the first rule for the traffic filter for filtering, from network communications external to the network, a second anomalous communication.

2. The non-transitory, processor-readable medium of claim 1 , the method further comprising:

comparing a normal communication with the first anomalous communication to determine an impact of the first rule.

3. The non-transitory, processor-readable medium of claim 1 , wherein the determining determines that the first anomalous communication includes the malicious payload, the method further comprising generating a second rule based on an anomaly associated with the malicious payload.

4. The non-transitory, processor-readable medium of claim 1 , the method further comprising:

determining an impact of the first rule on the network; and

updating the first rule to reduce the impact.

5. The non-transitory, processor-readable medium of claim 1 , the method further comprising:

routing the first anomalous communication to a predetermined component within the network, responsive to a determination that the first anomalous communication is associated with the service that does not exist within the network.

6. The non-transitory, processor-readable medium of claim 1 , the method further comprising:

making statistical categorization of the first anomalous communication at least partially based on chunks, the chunks being patterns in exact fingerprints of a previous communication.

7. The non-transitory, processor-readable medium of claim 1 , the method further comprising:

generating at least one of the tokens, using a sliding window for a length in bits.

8. A method, comprising:

receiving, from a traffic filter at a boundary of a network, a network communication;

determining which the network communication is, from among being a first anomalous communication associated with a service that does not exist within the network, using a non-readable character set, or including a malicious payload;

defining a fingerprint, based on an order of a plurality of tokens of a network protocol included in the first anomalous communication;

at least partially based on the determining, generating a first rule, at least partially based on an analysis of the fingerprint; and

communicating, to the traffic filter, the first rule for the traffic filter for filtering, from network communications external to the network, a second anomalous communication.

9. The method of claim 8 , further comprising:

comparing a normal communication with the first anomalous communication to determine an impact of the first rule.

10. The method of claim 8 , wherein the determining determines that the first anomalous communication includes the malicious payload, the method further comprising generating a second rule based on an anomaly associated with the malicious payload.

11. The method of claim 8 , further comprising:

determining an impact of the first rule on the network; and

updating the first rule to reduce the impact.

12. The method of claim 8 , further comprising:

routing the first anomalous communication to a predetermined component within the network, responsive to a determination that the first anomalous communication is associated with the service that does not exist within the network.

13. An apparatus, comprising:

a receiver that receives, from a traffic filter at a boundary of a network, a network communication; and

a processor configured to perform a determination as to which the network communication is, from among being a first anomalous communication associated with a service that does not exist within the network, using a non-readable character set, or including a malicious payload,

the processor further configured to define a fingerprint, based on an order of a plurality of tokens of a network protocol included in the first anomalous communication, and to, at least partially based on the determination, generate a first rule, at least partially based on an analysis of the fingerprint, wherein the receiver communicates, to the traffic filter, the first rule for the traffic filter for filtering, from network communications external to the network, a second anomalous communication.

14. The apparatus of claim 13 , wherein the processor further is configured to compare a normal communication with the first anomalous communication to determine an impact of the first rule.

15. The apparatus of claim 13 , wherein the processor further is configured to determine that the first anomalous communication includes the malicious payload, and to generate a second rule based on an anomaly associated with the malicious payload.

16. The apparatus of claim 13 , wherein the processor further is configured to determine an impact of the first rule on the network and to update the first rule to reduce the impact.

17. The apparatus of claim 13 , wherein the first anomalous communication is routed to a predetermined component within the network, responsive to a determination that the first anomalous communication is associated with the service that does not exist within the network.