Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware
AssigneeAlcatel Lucent
InventorsBassem Abdel-Aziz, Stanley Chow, Shu-Lin Chen
Life of this patent
Estimating the term…
Abstract
Malware detection systems are presented in which a list is constructed of enterprise hosts to or from which each given enterprise network host sends or receives packets within a current measurement period and statistics are accumulated based on two or more measurement period lists, with a count value being derived from the statistics to indicate the number of other hosts to or from which each monitored host sent or received packets, and one or more monitored hosts may be identified as suspected of being infected with slow and/or distributed scanning malware for which the count value exceeds a threshold value.
Claims16
A method of identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, the method comprising:
- constructing a current measurement period list of enterprise hosts to or from which each given host sent or received packets within a current measurement period;
- accumulating statistics based on two or more measurement period lists;
- deriving a count value from the accumulated statistics for monitored hosts, each count value being indicative of the number of other hosts to or from which each given monitored host sent or received packets;
- and
- selectively identifying one or more monitored hosts for which the count value exceeds a threshold value as suspected of being infected with slow and/or distributed scanning malware.
A system for identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, comprising:
- a network element operatively coupled to an enterprise network and operative to construct a current measurement period list of enterprise hosts to or from which each given host sent or received packets within a current measurement period;
- a malware detection component operative to accumulate statistics based on two or more measurement period lists from the network element, the malware detection component comprising:
- an analysis component operative to derive a count value from the accumulated statistics for one or more monitored hosts, each count value being indicative of the number of other hosts to or from which each given monitored host sent or received packets, and to selectively identify one or more monitored hosts for which the count value exceeds a threshold value as suspected of being infected with slow and/or distributed scanning malware.
A method of identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, the method comprising:
- constructing a current measurement period list of enterprise hosts to or from which each given host sent or received packets within a current measurement period;
- accumulating statistics based on two or more measurement period lists;
- deriving a count change value from the accumulated statistics for one or more monitored hosts, each count change value being indicative of a change in the number of other hosts to or from which each given monitored host sent or received packets;
- and
- selectively identifying one or more monitored hosts for which the count change value exceeds a change threshold value as suspected of being infected with slow and/or distributed scanning malware.
Dependencies are inferred from the claim text.