Suricata

It has been observed that as the emergency mode is approached, the engine's work increases substantially. In most cases, a steep increase in the number of flows per time interval is observed. This tells that the issue could perhaps be better handled as the change in the corve is very sudden. Jason proposed to look at the moving average of the flows/time graph and perhaps start an early prep if the moving average seems to be above a certain value .
This certain value is yet to be decided.