Detecting dissemination of malicious programs

#The present invention relates to the field of network security, and more particularly to detecting the randomness in destination addresses in order to detect dissemination of malicious programs.

#Network security management is becoming a more difficult problem as networks grow in size and become a more integral part of organizational operations. Attacks on networks are growing both due to the intellectual challenge such attacks represent for hackers and due to the increasing payoff for the serious attacker. Furthermore, the attacks are growing beyond the current capability of security management tools to identify and quickly respond to those attacks. As various attack methods are tried and ultimately repulsed, the attackers will attempt new approaches with more subtle attack features. Thus, maintaining network security is on-going, ever changing and an increasingly complex problem.

#One example of a network attack on a network device, e.g., server, may commonly be referred to as a denial-of-service attack. In a denial-of-service attack, the network device is flooded with so many additional requests that regular traffic is either slowed or completely interrupted. Typically, the denial-of-service attack uses multiple computers throughout the network. A denial-of-service attack that uses multiple computers may commonly be referred to as a distributed denial-of-service attack.

#A better understanding of the present invention can be obtained when the following detailed description is considered in conjunction with the following drawings, in which:

#FIG. 1 illustrates a network system configured in accordance with the present invention;

#FIG. 2 illustrates an embodiment of a client in the network system configured in accordance with the present invention;

#It is noted that even though the description of the present invention describes detecting the dissemination of a malicious program by detecting the randomness in IP destination addresses that additional factors may be used conjunctively or independently from the factor of detecting random IP destination addresses. For example, the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address and transfer will involve an unacknowledged datagram. These additional characteristics may be used conjunctively or independently from the factor of detecting random IP destination addresses. It is further noted that embodiments applying these additional characteristics either conjunctively to or independently from the factor of detecting random IP destination addresses would fall within the scope of the present invention.

#FIG. 1—Network System

#FIG. 1 illustrates an embodiment of a network system 100 in accordance with the present invention. Network system 100 may comprise one or more clients 101A-C coupled to an external network 103, e.g., Internet, via a gateway 102. Gateway 102 may be configured to function as an entry/exit point to external network 103 whereby gateway 102 performs protocol conversion between different types of networks. Clients 101A-C may collectively or individually be referred to as clients 101 or client 101, respectively. A more detailed description of client 101 is provided below in conjunction with FIG. 2. A more detailed description of gateway 102 is provided further below in conjunction with FIG. 4. In one embodiment, clients 101A-C may be coupled to a router (not shown) located at the edge of a subnet (not shown), e.g., Local Area Network (LAN), where the subnet may comprise clients 101A-C coupled to the router (not shown). It is noted that network system 100 may be divided into multiple subnets where each subnet (not shown), e.g., Local Area Network (LAN), Campus LAN, may be an interconnected, but independent, segment or domain of network system 100.