Patent Document ID: 9781157
Application ID: 15280936
Patent Flag: 1

Claim One:
1. A system comprising: a security device comprising a router, a switch, a firewall or a load balancer executing instructions to receive a network traffic as a plurality of packets; an intrusion detection system server executing instructions to capture and monitor a traffic flow through the security device; a server computer executing instructions to: identify, in real time within the plurality of packets, a plurality of statistics based on a traffic flow rate or a pattern data; execute a database query to select a threshold from the database, the threshold being calculated from a mean and a standard deviation of a plurality of historical statistics for a plurality of historical traffic flow rates or a plurality of historical pattern data; responsive to a determination that the plurality of statistics are beyond the threshold, activate or modify a mitigation settings script using a dynamic routing protocol to route the network traffic to at least one additional security device; and responsive to a determination that the plurality of statistics are within the threshold: execute a database query to insert the plurality of statistics into the database; calculate an updated mean and standard deviation including the plurality of statistics; and disable or modify the mitigation settings script to return the traffic flow to an original transmission route.