Patent ID: 8645537

Claim:
A method comprising: receiving a plurality of data packets communicated to an access provider for a computer system, each data packet including a payload portion and an attribute portion; identifying, from the attribute portion of at least one of the plurality of data packets, an IP address of at least one source of said at least one of the plurality of data packets; storing, in a data structure, an indication that received packets associated with the IP address are to be scanned; identifying one or more predetermined patterns at least by scanning at least one payload portion of the plurality of data packets, each of said at least one payload portion being associated with the IP address; controlling access of the at least one source to the computer system based on whether a quantity of the one or more predetermined patterns exceeds a threshold; and selecting to remove from the data structure or maintain in the data structure the indication that received packets associated with the IP address are to be scanned, said selecting being based on whether the quantity of the one or more predetermined patterns exceeds the threshold.