Patent ID: 7940657

Claim:
A method of identifying attackers on a network, the method comprising: receiving a data packet or part thereof at a discard processing module; generating a discard entry for the data packet; receiving the discard entry at a digest index module; hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature; processing the bin identification to associate the user signature with a first bin included in a plurality of bins, wherein each bin in the plurality of bins has a capacity; incrementing a discard count if the data packet cannot be processed because the first bin exceeds its capacity; processing the discard entry at the first bin into a first digest entry, wherein the first digest entry comprises identifying information associated with the data packet and a hit counter; incrementing a count entry for the data packet received at the discard processing module; incrementing a processed count for the data packet received at the digest index module; calculating a difference between the count entry and the processed count; and reporting the difference.