Patent ID: 7594263

Claim:
A method of operating a communication network, comprising: autonomously monitoring communication traffic at a communication port for an anomalous traffic; detecting an anomaly in communication traffic at a plurality of nodes in the communication network, wherein the anomaly is an attack other than a worm or virus; independently applying, at respective ones of the plurality of nodes, a first blocking measure A to the anomalous traffic that stops the anomalous traffic; independently determining, at the respective ones of the plurality of nodes, a second blocking measure B such that application of a logical combination of the first blocking measure A and the second blocking measure B stops the anomalous traffic; applying a logical combination of A and the second blocking measure B given by (A & !B) to the anomalous traffic, wherein the logical combination (A & !B) is a less restrictive blocking measure than a logical combination (A & B); and enforcing the logical combination (A & !B), if the logical combination (A & !B) stops the anomalous traffic.