초록 ▼

A method, system, apparatus, and computer-readable medium to detect rapidly propagating threats in a network. A rapidly propagating threat is detected by capturing a series of packets as the packets are communicated to nodes of the organizational network. The rapidly propagating threat can be detect

A method, system, apparatus, and computer-readable medium to detect rapidly propagating threats in a network. A rapidly propagating threat is detected by capturing a series of packets as the packets are communicated to nodes of the organizational network. The rapidly propagating threat can be detected without relying upon a known signature for the threat. Behavior of nodes when sending and receiving packets is examined for patterns typical of worm propagation.

대표청구항 ▼

What is claimed is: 1. A method comprising:in a first computer:capturing a first packet sent from a first source to a first destination; extracting a set of header data from a first header of the first packet; capturing a second packet sent from the first destination to a second destination;if the s

What is claimed is: 1. A method comprising:in a first computer:capturing a first packet sent from a first source to a first destination; extracting a set of header data from a first header of the first packet; capturing a second packet sent from the first destination to a second destination;if the set of header data is present in a second header of the second packet, processing the second packet as an indicator of a suspected rapidly propagating threat;capturing a third packet sent from the second destination to a third destination; searching the set of suspected threat packets for a linked packet to the third packet,wherein the linked packet has the second destination as a destination address;if the linked packet is found, comparing corresponding payload data for the linked packet to third payload data of the third packet, andif the corresponding payload data for the linked packet matches the third payload data,processing the third packet as part of a rapidly propagating threat.