The guard device learns characteristics of the normal pattern of traffic that is directed to each of IP addresses in the monitored set, such as the maximum rate of incoming packets, the distribution of source IP addresses, the protocols and ports that are used, and other parameters.