Patent ID: 8468590

Claim:
A method comprising: identifying, by a network device, a transmission associated with a denial of service attack in a network; determining, by the network device, a source of the transmission based on one or more characteristics of data associated with the transmission and based on a topology of the network; determining, based on the topology of the network, a location in the network between the network device and the source; forwarding, by the network device, instructions to rate limit, at the location, additional data received from the source; and rate limiting other data being transmitted within the network and not being associated with the source, the rate limiting of the other data further including: determining rate limits associated with, respectively, a plurality of data categories, the determining of the rate limits including: adjusting the rate limits, when applied during a first time period, based on an amount of data traffic received in each of the plurality of data categories during a second time period that occurs prior to the first time period, classifying units of the other data into at least one of the plurality of data categories, and rate limiting the other data based on the rate limits associated with the respective ones of the plurality of data categories to which the units of the other data are classified.