A method for protecting a packet switched network at a gateway server in the packet switched network, wherein the gateway server is arranged in communication paths between a network access server and a content server (170a-c) and between the network access server and an authentication server, comprising the steps of: receiving and storing user data (270a-b), wherein the user data includes: subscriber identifier data (272a-b) that indicates a unique identifier for a particular user, network address data (274a-b) that indicates a network address for a host (120a-b) used by the particular user, network access server data (276a-b) that indicates an identifier for the network access server, flow list data (280a-b) that indicates one or more open data packet flows, wherein an open data packet flow comprises a data packet that indicates a start of a series of data packets that pass through the gateway server for communications between the user and the content server without a corresponding termination of the series of data packets between the user and the content server, and suspicious activity data (282a-b) that indicates a value for a property of the open data packet flows that indicates suspicious activity, wherein the property that indicates suspicious activity is a number of the open data packet flows that are started within a particular period of time; the method further comprising: determining whether an intrusion condition is satisfied based on the suspicious activity data, said determining step comprising determining whether the number of the open data packet flows that are started within the particular period of time exceeds a threshold rate; and if it is determined that the intrusion condition is satisfied, then responding to the intrusion based at least in part on the subscriber identifier data. subscriber identifier data (272a-b) that indicates a unique identifier for a particular user, network address data (274a-b) that indicates a network address for a host (120a-b) used by the particular user, network access server data (276a-b) that indicates an identifier for the network access server, flow list data (280a-b) that indicates one or more open data packet flows, wherein an open data packet flow comprises a data packet that indicates a start of a series of data packets that pass through the gateway server for communications between the user and the content server without a corresponding termination of the series of data packets between the user and the content server, and suspicious activity data (282a-b) that indicates a value for a property of the open data packet flows that indicates suspicious activity, wherein the property that indicates suspicious activity is a number of the open data packet flows that are started within a particular period of time; determining whether an intrusion condition is satisfied based on the suspicious activity data, said determining step comprising determining whether the number of the open data packet flows that are started within the particular period of time exceeds a threshold rate; and if it is determined that the intrusion condition is satisfied, then responding to the intrusion based at least in part on the subscriber identifier data.