a malware detection and response system based on traffic pattern anomalies detection is provided , whereby packets associated with a variety of protocols on each port of a network element are counted distinctly for each direction . such packets include : arp requests , tcp / syn requests and acknowledgements , tcp / rst packets , dns / netbeui name lookups , out - going icmp packets , udp packets , etc . when a packet causes an individual count or combination of counts to exceed a threshold , appropriate action is taken . the system can be incorporated into the fast path , that is , the data plane , enabling communications systems such as switches , routers , and dslams to have built - in security at a very low cost .