Abstract: Various exemplary embodiments relate to a method for detecting that messages are incoming to a networked device above a target rate, the method including recording a timestamp for at least three representative samples of messages arriving at the networked device; calculating the duration of a focus group including one or more of the representative samples, wherein the target rate is a number r messages over a number m seconds and the focus group represents r/2 messages; and determining the duration of the focus group is less than m seconds.