In defending against various network attacks, such as distributed denial-of-service (DDoS)
attacks or worm attacks, a defense system needs to deal with various network conditions
and dynamically changing attacks. Therefore, a good defense system needs to have a built-
in" adaptive defense" functionality based on cost minimization-adaptively adjusting its
configurations according to the network condition and attack severity in order to minimize the
combined cost introduced by false positives (misidentify normal traffic as attack) and false …

An apparatus for optimizing a filter based on detected attacks on a data network includes an
estimation means and an opti mization means. The estimation means operates when a
detector detects an attack and the detector transmits an inac curate attack severity. The
estimation means determines an accurate attack severity. The optimization means adjusts a
parameter and the parameter is an input to a filter.