Patent ID: 7251215
Filing Date: 2007-07-31
Classification: H04L

Abstract:
1. A method comprising: receiving packets from a network via an interface card of a network device; calculating, with the network device, flow statistics for the packets; identifying, with the network device, a set of packet flows for the received packets based on the flow statistics; determining, with the network device, whether a traffic level for each of the packet flows of the received packets exceeds a threshold to identify suspicious packet flows; when the traffic level for one of the packet flows exceeds the threshold, intercepting the packets associated with the identified suspicious packet flows and directing the intercepted packets of the suspicious packet flows to a packet analysis module within the network device; analyzing, with the packet analysis module, contents of the intercepted packets of the suspicious packet flows to determine the presence of a network attack; updating routing information within the network device based on a result of the determination; and routing the packets with the network device in accordance with the routing information.