Patent ID: 8554948

Claim:
A method for identifying wanted traffic on the internet, comprising: determining a traffic history for a user of the internet; identifying wanted traffic in a stream of internet traffic based on the traffic history; prioritizing the wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic, and defining a heuristic, wherein identifying and prioritizing are performed based on the heuristic and wherein the heuristic comprises: a low port number heuristic that defines traffic in the stream of internet traffic as wanted traffic if any port numbers involved in a connection are below 1024; a low packet count heuristic that defines traffic in the stream of internet traffic as wanted traffic if five or fewer packets are seen in a flow; and a reverse flow seen heuristic that defines traffic in the stream of internet traffic as wanted traffic if a flow has been seen between a same pair of IP addresses in an opposite direction within a previous seven day period, wherein determining, identifying, prioritizing and defining are performed by at least one processor.