Endpoint Protection blocking internet connection.

I have a user that gets blocked from the internet periodically due to a setting within Endpoint Protection.  The warning he gets is similar to: 

Traffic from IP address 192.168.1.1 is blocked from 11:53pm to 12.03am.
Denial of Service is logged.

Has anyone heard of this before, or have any insite as the where the problem may lie?  I checked the Endpoint Protection logs, but I was unable to find any blatent issues.  The user states that it generally happens with malformed URL's, but I am unable to reproduce it at our helpdesk.