Patent ID: 7921460

Claim:
A system for detecting and responding to an attack, the system comprising: a first device comprising a first device processor, where the first device processor is configured to: receive data from a network, detect the attack based on the received data, transmit, via the network, first control information, the first control information comprising: information indicating that an attack has been detected, and one or more characteristics of the received data related to the attack; receive additional data from the network after the first control information has been transmitted, and transmit updated rate limit information based on an amount of the additional data received and a processing capability of a device to which the additional data is destined; and a plurality of second devices positioned upstream from the first device, where each of the plurality of second devices comprises a second device processor and where the second device processor for one of the plurality of second devices is configured to: receive the first control information, determine, based on a topology of the network and the one or more characteristics, whether to apply the first control information, when the second device processor determines to apply the first control information at the one of the plurality of second devices, limit, based on the first control information, a rate at which data is forwarded by the one of the plurality of second devices; and when the second device processor determines not to apply the first control information at the one of the plurality of second devices, forward, based on the topology of the network, the first control information to another of the plurality of second devices.