Containment mechanism for potentially contaminated end systems

A malware detection and response system for a network element connected at an edge of a communication network, comprising:

• a header data processing unit for examining header data of each protocol data unit (PDU) seen on a port of said network element and identifying a PDU type;
• a counters unit for providing a plurality of count values for each traffic direction based on said identified PDU type, wherein the counters unit further comprises:
• a plurality of simple counters, each simple counter for maintaining an individual count value providing the number of PDUs of a specified PDU type seen on said port, for a respective traffic direction, and
• a complex counters unit for determining the number of far-end hosts that exchange PDUs over said port;
• a storage unit that stores a limits table setting a corresponding limit for each said count value and a rules set for defining attack patterns and containment actions for said port;
• and
• an attack identification and containment unit for identifying a type of attack by comparing the plurality of count values to corresponding limits in the limits table and correlating the comparison to the rules set, and for initiating a defense action for containing said type of attack.