System and method of identifying the source of an attack on a computer network

A computer-readable medium bearing computer-executable instructions that, when executed, carries out a method of identifying the source of a malware that was released onto a communication network, the method comprising:

• (a) obtaining the memory state of a plurality of computing devices connected to the communication network;
• (b) determining that the malware was released onto the communication network;
• (c) identifying computing devices in the communication network that are infected with the malware;
• and
• (d) tracing the spread of the malware between computing devices infected with the malware.

A software system for identifying the source of a malware that was released onto a communication network, the software system comprising:

• (a) anti-virus software for detecting the presence of suspicious data on a client computing device;
• (b) an application program interface to present functions to software applications for reporting suspicious data;
• (c) an operating system for capturing the memory state of the computing device when suspicious data is reported;
• and
• (d) a memory collection database operative to store data that captures the memory state of the computing device received from the operating system.