1. An apparatus for optimizing a filter based on detected attacks on a data network comprising: a. an estimation means, wherein the estimation means operates when a detector detects an attack and the detector transmits an inaccurate attack severity, and wherein the estimation means determines an accurate attack severity; b. an optimization means, wherein the optimization means adjusts a parameter, and wherein the parameter is an input to a filter; wherein the filter comprises a detector and a packet blocking means; and c. a buffer aware function, wherein the buffer aware function optimizes the maximum number of normal requests a server is capable of accepting based on the quantity of connections or specific performance connections.