Patent ID: 8918838

Claim:
A device comprising: a processor and addressable memory, the addressable memory comprising a set of one or more rules, wherein the processor is configured to: for each packet from a set of one or more packets: log packet information in a data store by comparing the packet with a set of previously received packets; determine if the packet is part of an established connection or if the packet is part of a new connection based on the comparison; if determined that the packet is of an established connection, then perform a set of rules on a subset of the one or more packets, wherein the subset of the one or more packets is determined based on a previously selected number of packets; if determined that the packet is of a new connection, then perform the set of rules on all the packets of the set of one or more packets; determine whether the packet is part of a created accepted rules list, wherein the list is at least one of: a white list, a black list, and a custom rule list; if the packet is determined to be part of a created accepted rules list, then bypass filtering for the packet; if the packet is determined to not be part of a created accepted rules list, then assign escalating time-based internet protocol traffic blocks against the set of previously received packets based on: type of offense, volume of internet protocol traffic, and at least one of: internet protocol traffic patterns, detected threats by an intrusion detection system device, and packet header properties; and perform rate limiting on the packet based on the logged packet information and accepted rules list determination, wherein the device is between a secured network and a source node, wherein the secured network is behind a firewall, and wherein the set of one or more packets is generated by and originated from the source node, destined for the secured network.