Patent ID: 7620986

Claim:
A method, including steps of: operating a first computing device coupled to a distributed computing environment; maintaining a record of a first pattern of legitimate message traffic; comparing a pattern of current message traffic received at the first computing device to said record of the first pattern of legitimate message traffic; and taking action in response to said steps of comparing, including: determining if the pattern of current message traffic includes attack traffic; operating a second computing device coupled to said distributed computing environment and disposed to receive messages from said first computing device to ameliorate said attack traffic; wherein the steps of taking action to ameliorate the attack traffic include steps of: sending information regarding said pattern of current message traffic to a logically distinct location in a network; comparing said information to a second pattern of message traffic at the logically distinct location; and determining if the second pattern of message traffic at the logically distinct location includes attack traffic and ameliorating the attack traffic.