Anti-cyber hacking defense system

A method comprising:

• receiving, by a computing device having a processor and addressable memory, a set of one or more packets;
• logging, by the computing device, packet information in a data store by comparing packets with a set of previously received packets;
• determining, by the computing device, for each packet from the set of one or more received packets, if a connection is an established connection or a new connection based on the comparison;
• performing, by the computing device, a set of rules on a subset of the one or more packets, if determined that the packet is of an established connection, wherein the subset of the one or more packets is determined based on a previously selected number of packets;
• performing, by the computing device, all the set of rules for all the packets of the set of one or more packets if determined that the packet is of a new connection;
• determining, by the computing device, whether the packet is part of a created accepted rules list, wherein the list is at least one of:
• a white list, a black list, and a custom rule list;
• bypassing, by the computing device, filtering for the packet, if the packet is determined to be part of a created rules list;
• assigning, by the computing device, escalating time-based internet protocol traffic blocks against a host of the set of previously received packets if the packet is determined to not be part of a created accepted rules list;
• performing, by the computing device, rate limiting on the packet based on the logged packet information and accepted rules list determination;
• determining, by the computing device, if the host of the set of one or more packets is a non-offending host, wherein the determination is based on a query to the data store for unaccepted, not established, and not related packets within a specified time window;
• and
• de-listing, by the computing device, the determined non-offending host from the black list wherein the host has an internet protocol address and the internet protocol address is removed from the data store.

A system comprising a computing device, a secured network, and a source node:

• wherein the source node comprises a processor, the processor configured to:
• send a set of one or more packets to the secured network;
• wherein the computing device comprises a processor and memory, the processor configured to:
• for each packet from the set of one or more packets received from the source node:
• log packet information in a data store by comparing the packet with a set of previously received packets;
• determine if the packet is part of an established connection or if the packet is part of a new connection based on the comparison;
• if determined that the packet is of an established connection, then perform a set of rules on a subset of the one or more packets;
• if determined that the packet is of a new connection, then perform the set of rules on all the packets of the set of one or more packets;
• determine whether the packet is part of a created accepted rules list;
• if the packet is determined to be part of a created accepted rules list, then bypass filtering for the packet;
• if the packet is determined to not be part of a created accepted rules list, then assign escalating time-based internet protocol traffic blocks against a host of the set of previously received packets;
• perform rate limiting on the packet based on the logged packet information and the created accepted rules list determination;
• determine if a host of the set of one or more packets is a non-offending host, wherein the determination is based on a query to the data store for unaccepted, not established, and not related packets within a specified time window;
• and
• de-list the determined non-offending host from the black list wherein the host has an internet protocol address and the internet protocol address is removed from the data store;
• and
• wherein the secured network comprises a processor, the processor configured to:
• receive the set of one or more packets based on if the packet is determined to be part of the created accepted rules list and at the rate limited by the computing device.