There is disclosed a system and method for detecting attacks on a site in a communication network and for taking action to reduce or redirect such attacks. A monitor system reviews incoming data packets and sends directions to at least one router to change the data flow in the system. The directions may be sent to other routers. The data packets and the resulting work flow are modified for certain conditions, and for certain conditions within defined time slices, and action is taken when the monitored condition is contrary to expected conditions.