In an edge network, message traffic between the edge network and a 
core network passes through the edge 
router. A port scanning 
attack directed to the network as a whole (
core network) potentially emanates from within the LAN. The edge 
router includes a network throttling device which identifies and mitigates harmful transmissions such that they do not propagate to the 
core network. The network throttling device has a connection 
daemon to scan transactions and determine deviant or atypical connection attempts. A session 
database stores a transaction history representing a window of previous connection attempts. A pattern 
detector examines the history and looks for malicious behavior. Identified deviant patterns cause a throttler enforcer to limit the triggering user by restricting future connection attempts, thus mitigating harmful effects. Usage, therefore, is not prevented, but resilience to deviant practices is provided. Accordingly, 
virus propagation via port scanning is mitigated to a safe level and false alarms targeting legitimate activity are minimized.