Patent ID: 7757283

Claim:
A method of detecting abnormal traffic at a node of a communications network equipped with an intrusion detection/prevention system (IDS/IPS), the method comprising: monitoring the status of a traffic flow input to said node to establish when said traffic flow carries suspicious data traffic, by looking only at a subset of data traffic in said traffic flow, wherein the step of monitoring comprises: assigning a risk class from a plurality of risk classes to said traffic flow based on vulnerabilities recognized for a protocol used by said traffic flow, the plurality of risk classes including an “at risk” class or a “not at risk” class, measuring a rate of the subset of data traffic in said traffic flow, and comparing the rate of said subset of data traffic to a first threshold if said traffic flow belongs to the “at risk” class, comparing the rate of said subset of data traffic to a second threshold if said traffic flow belongs to the “not at risk” class, wherein the first threshold is lower than the second threshold, flagging said traffic flow as a suspicious traffic flow when the rate of the subset of data traffic is above a respective one of said first and second thresholds; and triggering an early notification once the status of said traffic flow is flagged as a suspicious traffic flow.