Patent ID: 8510833

Claim:
A method of connection-rate filtering within a sub-network by a network device, the method comprising: measuring, via the circuitry at a controller, a traffic rate of packets from an ingress port that are destined for a gateway address outside the sub-network; comparing, via the circuitry at the controller, the measured traffic rate with a first threshold rate; sampling, via the circuitry at the controller, packets from the ingress port that are destined for the gateway address outside the sub-network over a period of time if the first threshold rate is exceeded by the measured traffic rate; and analyzing, via the circuitry at the controller, the sampled packets; the method further comprising: monitoring address resolution protocol (ARP) request packets received from a sub-network by a network device; sending a copy of the received ARP request packets to an agent program in the sub-network; determining by the agent program a rate of ARP request packets sent by a host in the sub-network; and identifying the host as being potentially infected with malicious code based on the determined rate of ARP request packets.