Abstract: A method of detecting network anomalies includes the reception, via an interface of an electronic device, of a first stream of packets sent by a source that is external and/or the transmission of a first stream of packets to a destination external; the computation, by a processing circuit, of a first packet stream identifier based on at least one of: a packet source address of the packets of the first stream; and a packet destination address of the first stream; searching, in an ordered dynamic data structure stored in a memory and including a plurality of entries. The searching is performed based on the value of the first packet stream identifier with respect to one or more search threshold values; and based on metadata associated with the first entry, blocking reception of the first stream of packets.