Patent Document ID: 9749355
Application ID: 14668432
Patent Flag: 1

Claim One:
1. A non-transitory machine readable storage medium having instructions embodied thereon, the instructions when executed by a processor: analyze historical network packets to determine a number of occurrences of atypical values for selected packet attributes; identify a network packet intended for a destination host on a computer network; analyze a packet header for the network packet for a plurality of packet attributes having atypical values indicating that the network packet is associated with a potential attack on the computer network, wherein an atypical value for a packet attribute does not correspond to an expected value for the packet attribute and the atypical value complies with a communication protocol standard for the packet attribute; obtain suspicion weights assigned to the plurality of packet attributes that are identified as having the atypical values indicating that the network packet is associated with the potential attack on the computer network, wherein the suspicion weights are inversely proportional to the number of occurrences of the atypical values of the selected packet attributes in the historical network packets; calculate a suspicion score for the network packet using the suspicion weights for the plurality of packet attributes that are identified as being associated with the potential attack; determine network capacity for the computer network that the network packet is intended to travel through to reach the destination host; and determine whether to drop the network packet based, at least in part, on the network capacity for the computer network and the suspicion score for the network packet.