Hash-based systems and methods for detecting, preventing, and tracing network worms and viruses

A system for hampering transmission of a potentially malicious packet, comprising:

• means for receiving a packet;
• means for generating one or more hash values from the packet;
• means for comparing the generated one or more hash values to hash values corresponding to prior packets;
• means for determining that the packet is a potentially malicious packet when the generated one or more hash values match one or more of the hash values corresponding to at least one of the prior packets and the at least one of the prior packets was received within a predetermined amount of time of the packet;
• and
• means for hampering transmission of the packet when the packet is determined to be a potentially malicious packet.

A system for detecting transmission of potentially malicious packets, comprising:

• a plurality of input ports configured to receive a plurality of packets;
• a plurality of output ports configured to transmit the packets;
• a hash processor configured to:
• observe each of the packets received at the input ports,
• generate hash values corresponding to the packets,
• compare the generated hash values to hash values corresponding to previous packets, and
• determine that one of the packets is a potentially malicious packet when one or more of the generated hash values corresponding to the one packet matches one or more of the hash values corresponding to one of the previous packets and the one previous packet was received within a predetermined amount of time of the one packet.

A system for detecting transmission of a potentially malicious packet, comprising:

• an input port configured to receive a plurality of packets;
• an output port configured to transmit at least some of the packets;
• and
• a hash processor configured to:
• receive a message identifying a potentially malicious packet,
• generate a plurality of hash values from the potentially malicious packet,
• determine whether any of the generated hash values match hash values corresponding to prior packets received at the input port, and
• identify the potentially malicious packet as one of the prior packets when one or more of the generated hash values match the hash values corresponding to the prior packets.

A method for detecting a path taken by a potentially malicious packet, comprising:

• storing a plurality of hash values corresponding to received packets;
• receiving a message identifying a potentially malicious packet;
• generating a plurality of hash values from the potentially malicious packet;
• comparing the generated hash values to the stored hash values;
• and
• determining that the potentially malicious packet was one of the received packets when one or more of the generated hash values match the stored hash values.