Patent ID: 8789173
Filing Date: 2014-07-22
Classification: H04L

Abstract:
1. A method comprising: monitoring, with a first network device, network connections to a second network device protected by the first network device; upon determining that a parameter associated with the monitored network connections exceeds a connection threshold, monitoring each of a plurality of types of transactions associated with the network connections, wherein monitoring each of the plurality of types of transactions comprises determining a rate at which transactions for each of the plurality of types of transactions is received as the parameter associated with the at least one of the plurality of types of transactions; upon determining that a parameter associated with at least one of the plurality of types of transactions exceeds a corresponding transaction-type threshold, monitoring communications associated with network addresses from which transactions of the at least one of the plurality of types of transactions originate, wherein determining that the parameter associated with the at least one of the plurality of types of transactions exceeds a transactions threshold comprises determining that the rate at which transactions of the at least one of the plurality of types of transactions exceeds the transaction-type threshold, wherein the transaction-type threshold defines a threshold rate at which transactions for the at least one of the plurality of types of transactions are to be received; and executing a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a corresponding client-transaction threshold.