Hybrid hardware-software distributed threat analysis

A method for analyzing network communications, the method performed by a device, the method comprising:

• performing in-line packet inspection of packets sent to/from an interface of a host on a network, wherein each packet is inspected by computing identifiers of respective same portions of each packet being inspected;
• accumulating statistics of the computed identifiers, respectively, wherein each identifier has a corresponding statistic, and wherein each statistic corresponds to cumulative occurrences of, and/or frequency of, computations of a corresponding identifier from respective packets;
• and
• via the network, repeatedly transmitting reports of the identifiers, each report comprising whichever of the identifiers have the prevailing cumulative statistics at different times corresponding to the respective reports, wherein each transmitted report includes the cumulative statistics of its respective identifiers.

Storage hardware storing information configured to enable an apparatus comprising a host and/or a NIC to perform a process, the process comprising:

• maintaining a data structure that stores identifiers of arbitrary packet features in association with respective occurrence measures of the packet features;
• inspecting network packets sent to and/or from the host to compute the identifiers from the arbitrary packet features therein, wherein the identifiers substantially uniquely identify corresponding unique arbitrary packet features, respectively;
• each time an identifier is computed from a corresponding packet and the identifier is not in the data structure, adding the identifier to the data structure;
• each time an identifier is computed from a corresponding packet, updating an occurrence measure, in the data structure, that is associated with the identifier;
• and
• selecting and transmitting summary information of the identifiers in the data structure.