Patent ID: 7590728

Claim:
A system for detecting aberrant network behavior by clients of a network access gateway, comprising: a processor; a first network interface coupled to the processor; a storage media accessible by the processor; a set of computer instructions executable by the processor to: observe a network communication received at the first network interface, wherein the network communication is associated with a first client; determine if aberrant network behavior is occurring with respect to a first client wherein determining if the network behavior is aberrant comprises: analyzing the network communication associated with the first client based up on one or more rules to determine if the network communication corresponds to a first rule of the one or more rules, wherein the rules are configured to identify particular network communications, and if the network communication is corresponds to the first rule forming a notification corresponding to the first rule of the one or more and updating a list of statistical information to the first rule based upon the notification wherein the statistical information is accumulated over a first time period and the list is one of a set of lists corresponding to the first client, each list comprising statistical information associated with at least one of the one or more rules, and testing the statistical information in the list associated with the first rule and the first client using at least one of a set of conditions corresponding to aberrant network behavior, wherein each of the set of test conditions comprises conditions associated with at least one list of the sets of lists and at least one of the set of test conditions corresponds to a second time period.