Automatic adjusting of reputation thresholds in order to change the processing of certain packets

Abstract

One embodiment includes a firewall, intrusion prevention, or other device that automatically and dynamically adjusts packets subjected to certain rate limiting based on the reputation level associated with these packets (e.g., based on the reputation score of the source of a packet). In response to measured traffic, one embodiment automatically adjusts the range of reputation scores determining which packets are subjected to this rate limiting (e.g., which packets are possibly dropped), such as, but not limited to increase or decrease the measured traffic. For example, packet traffic with a worse reputation can be singled out for this rate limiting during a period of increased traffic, and then when the measured traffic subsides, the range of reputation scores can be correspondingly changed to allow more measured traffic.