Propagation of viruses through an information technology network
AssigneeHewlett-Packard Development Company, L.P.
InventorsMatthew Murray Williamson, Andrew Patrick Norman
Life of this patent
Estimating the term…
Abstract
Requests to send data from a first host within a network of hosts are monitored against a record of destination hosts who have been sent data in accordance with a predetermined policy. Destination host identities not the record are stored in a buffer. The buffer size is monitored to establish whether requests from the first host are pursuant to viral activity therein.
Claims41
A method of monitoring propagation of viruses by a first host within a network of hosts, the method comprising the following steps carried out by the first host:
- establishing a record which is at least indicative of identities of destination hosts within the network to whom data has been sent by a first host;
- during a first time interval, comparing (a) identities of destination hosts identified in requests to send data from the first host and (b) identities of destination hosts identified in the record;
- transmitting all requests to send data;
- and
- storing in a buffer data relating to requests which identify a destination host not in the record, wherein the record is established by monitoring identities of destination hosts to whom requests have been transmitted during a second time interval, which precedes the first time interval.
A method of operating a first host within a network of a plurality of hosts, the method comprising the following steps carried out by a first host:
- over the course of a first time interval, monitoring creation of sockets within the first host to identify destination hosts identified therein;
- comparing identities of destination hosts monitored during the first time interval with destination host identities in a record;
- and
- storing data from all sockets which identify monitored destination hosts not in the record, wherein the record identifies a maximum number of destination hosts, the maximum number being determined in accordance with a policy.
A method of monitoring propagation of viruses by a first host within a network of hosts, the method comprising the following steps carried out by the first hosts:
- establishing a record which is at least indicative of identities of destination hosts within the network to whom data has been sent by the first host;
- during a first time interval, comparing (a) identities of destination hosts identified in requests to send data from the first host and (b) identities of destination hosts identified in the record;
- transmitting all requests to send data;
- based on the result of the comparing, storing in a buffer data to identify as such those requests which identify a destination host not in the record;
- and
- determining a slack parameter based upon a number of successive time periods that pass when no new requests are made to send data from the first host to hosts not in the record and when the slack parameter exceeds a predetermined value, allowing unimpeded passage of data from the first host to destination hosts not in the record.
Dependencies are inferred from the claim text.