Patent ID: 8762517

Claim:
A process comprising: monitoring data about a user's usage of a network; determining from the monitored data that the user's network usage has exceeded a level indicative of an event using a control system that comprises one or more computing devices; determining, by the control system, whether the event is a security incident by comparing the user's network usage to one or more of a usage of other users and a historical usage of the user, wherein determining whether the event is a security incident comprises determining whether the user's network usage is consistent with a normal network usage, and wherein an abnormal network usage indicates the event is a security incident; if the event is not determined to be a security incident, the control system sending the user an offer to change usage plans that will result, if the offer is accepted, in an adjustment to the amount of bandwidth allocated to the user; and if the event is determined to be a security incident, the control system restricting the user's access to the network.