Method, apparatus, and computer program product for detecting computer worms in a network
US8032937B2 · kind B2 · utility
4Cited by
1References
55Claims
0Family size
Assignee
Inventor
Key dates
| Filing date | Oct 26, 2004 |
| Grant date | Oct 4, 2011 |
| Priority date | — |
| Expiry date | Apr 2, 2027 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1425
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A worm is a malicious process that autonomously spreads itself from one host to another. To infect a host, a worm must somehow copy itself to the host. The method in which a worm transmits a copy of itself produces network traffic patterns that can be generalized as a traffic behavior. As a worm spreads itself across the network, the propagation of the traffic behavior can be witnessed as hosts are infected, one after another. By monitoring the network traffic for propagations of traffic behaviors, a presence of a worm can be detected.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.