Patent ID: 8020207

Claim:
A malware detection and response system for a network element connected at an edge of a communication network, comprising: a header data processing unit for examining header data of each protocol data unit (PDU) seen on a port of said network element and identifying a PDU type; a counters unit for providing a plurality of count values for each traffic direction based on said identified PDU type, wherein the counters unit further comprises: a plurality of simple counters, each simple counter for maintaining an individual count value providing the number of PDUs of a specified PDU type seen on said port, for a respective traffic direction, and a complex counters unit for determining the number of far-end hosts that exchange PDUs over said port; a storage unit that stores a limits table setting a corresponding limit for each said count value and a rules set for defining attack patterns and containment actions for said port; and an attack identification and containment unit for identifying a type of attack by comparing the plurality of count values to corresponding limits in the limits table and correlating the comparison to the rules set, and for initiating a defense action for containing said type of attack.