Automatic adjusting of reputation thresholds in order to change the processing of certain packets

摘要

A firewall, intrusion prevention or other device automatically and dynamically adjusts packets subjected to certain rate limiting based on the reputation level associated with their source. When measured traffic increases beyond a desired amount, the range of reputation scores causing their associated packets to be subjected to this rate limiting is adjusted to throttle the measured traffic to fall within desired limits. In this manner, packet traffic with a worse reputation can be singled out for this rate limiting during a period of increased traffic. When the measured traffic subsides, the range of reputation scores can be correspondingly changed to allow more measured traffic.

主权项

1. A method performed by a particular networked machine, the method comprising:
rate limiting, by the particular networked machine, of a first plurality of packets of a greater plurality of packets, wherein packets received by the particular networked machine are identified as being in the first plurality of packets when their source has a worse reputation score than a predetermined reputation score threshold; and wherein packets received by the particular networked machine are not identified as being in the first plurality of packets when their source has a better reputation score than the predetermined reputation score threshold; and in response to measured traffic of the greater plurality of packets equaling or exceeding one or more predetermined traffic measurement thresholds: automatically adjusting, by the particular networked machine, the reputation score threshold to a better reputation score thus expanding the first plurality of packets to now include packets associated with a higher reputation score on which the particular networked machines performs said rate limiting.