has not yet occurred the ager 315 simply returns from this record if the record has already timed out the intrusion statistics are updated and the record is unblocked the host can read the intrusion statistics this can be done using an interrupt mechanism fig1 depicts the process 1000 of updating the continuous learning statistics described in fig1 a continuous learning mechanism is utilized to get a baseline for normal traffic during the period of no intrusion the mechanism can be used to get continuous samples for a plurality of traffic characteristics such as port traffic traffic using a certain ip option traffic from a single source or to a single destination etc this is used to predict the threshold for traffic so that intrusions can be detected when the thresholds are reached crossed later a traffic counter is initialized to zero when a record is created this holds the value for traffic so far another counter is created for an ager period this counter holds the traffic during the ager period this counter is incremented for every packet that meets the traffic criterion during the ager cycle the counter for this period is compared against the counter so far if the counter for this period is greater than the counter so far the counter so far is replaced with the counter for this period the counter so far is used to predict the threshold fig1 depicts a chart which graphically shows the technique for threshold estimation the dotted line 1201 shows traffic samples taken using continuous learning process described in fig1 these samples are used to forecast the.