Method and system for operating system identification in a network based security monitoring solution

A system for network based malware detection in a service provider network, the system comprising:

• a network sensor coupled to the service provider network, the network sensor:
• receives one or more transmission control protocol (TCP) packets originating from an access device coupled to the service provider network, the one or more TCP packets defining a TCP session between a computing device coupled to the access device, and a destination coupled to the service provider network;
• determines an operating system identifier (OS ID) associated with the TCP session and the computing device associated;
• determines if malware is present in the TCP session and an associated malware ID by comparing a malware signature to the one or more TCP packets;
• and
• generates an alert identifying a network address associated with the access device, the malware ID and the OS ID associated with TCP session that generated the alert;
• and
• a remediation portal coupled to the service provider network, the remediation portal:
• identifies a subscriber accessing the remediation portal;
• identifies the OS associated with the computing device used by the subscriber to access the remediation portal;
• compares the OS associated with the computing device to the OS ID identified in the alert;
• and
• provides malware remediation to the computing device.

A computer readable memory containing instructions for network based malware detection in a service provider network, the instructions when executed by a processor performing:

• receiving one or more transmission control protocol (TCP) packets originating from an access device coupled to the service provider network, the one or more TCP packets defining a TCP session between a computing device coupled to the access device, and a destination coupled to the service provider network;
• determining an operating system identifier (OS ID) associated with the TCP session and the computing device;
• determining if malware is present in the TCP session and an associated malware ID by comparing a malware signature to the one or more TCP packets;
• and
• generating an alert identifying a network address associated with the access device, the malware ID and the OS ID associated with TCP session that generated the alert.