Patent ID: 8170020

Claim:
A standalone network filter coupled to a computer system, the filter comprising: a network interface supporting a plurality of ports; a controller operable to route traffic originating from a sender that is received at an inactive port of the plurality of ports; and a processing unit operable to: receive the traffic routed from the controller; obtain, from the traffic, traffic data including routing information for the traffic, source information about the sender, and payload information of the traffic; based at least in part on the traffic data obtained from the traffic, categorize the traffic on the inactive port as a threat; categorize the traffic on the inactive port as having a predetermined attack profile; determine that the traffic meets a threshold number of communication attempts by the sender at the inactive port; responsive to determining that the traffic meets a threshold number of communication attempts at the inactive port, perform protective measures comprising: using the traffic data obtained from the traffic to provide a delayed response with an inflated error rate on the inactive port, wherein the delayed response communicates to the sender that a vulnerability exists on the computer system and causes the sender to allocate additional resources to continue attacking the computer system via the inactive port; manipulating a payload size of the traffic from the sender on the inactive port to reduce communication bandwidth; and notifying a neighboring server and a clearinghouse of at least a portion of the traffic data obtained from the traffic.