Patent ID: 8261346

Claim:
A method for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the method comprising: using an intrusion detection sensor apparatus for: receiving data traffic on the data communications network; storing an assigned address and unassigned address records, said unassigned address comprising an address which is free and not assigned to any data processing system on said data communications network; and identifying the data traffic originating at any assigned address and addressed to any unassigned address, by comparing the data traffic destination address to said address table; using a router operably coupled with the intrusion detection sensor for automatically routing the data traffic addressed to the unassigned address to a physical device for intrusion detection on which said method operates; using the intrusion detection sensor for: inspecting the data traffic so identified for known data signatures indicative of an attack, wherein the attack spans more than one packet; on detection of the known data signatures indicative of said attack, sending an alert message to a disinfection address on the data communications network, wherein said alert message comprises attack identity data; using a disinfection server assigned to the disinfection address for sending, upon receipt of the alert message, a warning message to the address assigned to a data processing system originating the data signatures indicative of the attack, wherein said warning message comprises program code for eliminating the attack when executed by the data processing system; and billing said entity for the execution of at least one of the foregoing steps, the charge being billed being determined in dependence of at least one of: a size of the network, the number of unassigned addresses monitored, the number of assigned addresses monitored, a volume of data traffic inspected, a number of attacks identified, a number of alerts generated, a signature of the identified attack, a volume of rerouted data traffic, a degree of network security achieved, and a turnover of said entity.