Example: Variable dynamic throttling for traffic regulation events

Suppose you have created the following traffic regulation policy with throttling set to 50 percent. An intrusion event is generated when the number of established TCP connections exceeds 1000 connections, or exceeds 10% of the total number of connections to the system during a 10-minute interval. The maximum number of event messages during each statistics interval is 1. At this point, throttling begins. Input from all IP addresses coming in on port 80 is cut back to just 50% for 10 minutes (the statistics interval). During this time period, IDS keeps statistics for the given protocol, range of IP addresses, and ports. After the statistics interval ends, IDS evaluates whether to continue to throttle during the next 10-minute interval, based on the statistics gathered during the throttled interval.