Patent ID: 8266696

Claim:
A method for protecting a packet switched network at a service gateway, comprising the steps of: receiving user data at a gateway server in a communication path on a packet switched network between a network access server and a content server, wherein the user data includes subscriber identifier data that indicates a unique identifier for a particular user, network address data that indicates a network address for a host used by the particular user, NAS data that indicates an identifier for the network access server, flow list data that indicates one or more open data packet flows, wherein an open data packet flow comprises a data packet that indicates a start of a series of data packets that pass through the gateway server for communications between the user and the content server without a corresponding termination of the series of data packets between the user and the content server, and suspicious activity data that indicates a value for a property of the open data packet flows that indicates suspicious activity; determining whether an intrusion condition is satisfied based on the suspicious activity data, wherein the intrusion condition is associated with a scanning attack, which is identified through the suspicious activity data by recognizing an excessive number of open flows being established per second such that other flows are denied access because of the excessive number of open flows; and if it is determined that the intrusion condition is satisfied, then responding to the intrusion by dropping packets originated from an Internet Protocol (IP) address associated with the particular end user and by sending a message to remove the particular end user's IP address from a list of authorized users for the network; and communicating a message based on the subscriber identifier data to a billing agent that is involved in determining charges for a particular user for causing the billing agent to penalize the particular user.