Patent ID: 7743415

Claim:
A process that monitors network traffic through a monitoring device disposed between a data center and a network for thwarting denial of service attacks on the data center, the process comprises: a detection process to determine if the values of a parameter of network traffic exceed normal values for the parameter to indicate an attack on the data center; a characterization process to build a histogram for the parameter to compute significant outliers in a parameter and classify the attack; and a filtering process for filtering of network packets based on the characterization process, wherein the filtering process comprises: constructing a master correlation bit vector, wherein bits of the master correlation bit vector correspond to parameter correlations; initializing bits of a packet's correlation bit vector as not suspicious; retrieving a parameter from a parameter suspicious correlation bit vector, which comprises a list of suspicious values for the parameter, to construct the packet's correlation bit vector; and using a value of the packet's correlation bit vector to index the master correlation bit vector.