A method of adaptively classifying information using a binary tree
comprises establishing a binary tree including a set of binary sequences
each representing one or more network addresses. Once network traffic is
received having identifiers describing network traffic sources, the
identifiers are correlated to binary sequences within the binary tree. A
revision metric is formed based on this correlating, and the binary tree
is then revised according to this revision metric.A method of blocking a
DDOS attack comprises establishing a binary tree including a set of
binary sequences, each of these binary sequences representing one or more
network addresses. When network traffic is received having identifiers
describing network traffic sources, the identifiers are correlated to
binary sequences within the binary tree. Once a DDOS attack notification
signal is received, a selected binary tree path within the binary tree is
identified as a low cost blocking path within the binary tree. Network
traffic correlated to a binary sequence corresponding to the selected
binary tree path is blocked.