# US 8,572,197 B2 · Method of detecting compromised computers in a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,197 B2
- Document ID: US8572197B2
- Status: Granted
- Kind: B2
- Application number: 13/632,384
- Filed: 2012-10-01
- Published: 2013-02-14
- Granted: 2013-10-29
- Earliest claimed: 2009-04-20
- Assignees: The Florida State University Research Foundation, Inc.
- Applicants: The Florida State University Research Foundation, Inc.
- Inventors: Zhenhai Duan; Peng Chen
- Web page: https://patentgrep.com/patent/US8572197B2

## CPC

- H04L 63/0245: {Filtering by information in the payload}
- H04L 51/212: using filtering or selective blocking
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 69/329: in the application layer [OSI layer 7]
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2129: Authenticate client device independently of the user
- H04L 2463/144: Detection or countermeasures against botnets
- H04L 2463/146: Tracing the source of attacks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method of detecting a compromised machine on a network. The method receives an email message from a machine on the network and classifies it as either spam or non-spam. A probability ratio is then updated, according to whether the message was spam or non-spam, by applying a sequential probability ratio test. If the probability ratio is greater than or equal to a first threshold, then the machine is compromised. If the probability ratio is less than or equal to a second threshold, then the machine is normal. The operations of receiving a message, classifying the message, updating the probability ratio, and indicating the machine is normal or compromised until the probability ratio is greater than or equal to the first threshold are repeated for a plurality of messages. Such repeated operations are performed on each of the messages one at a time, as each of the messages is received.

## Claims

### Claim 1

A computer implemented method of detecting a compromised machine on a network, comprising:
establishing the network having at least one designated mail server, the mail server relaying all outgoing email messages originating from the network;
co-locating a compromised machine detection system with the at least one designated mail server to examine the outgoing email messages;
receiving an email message from a machine on the network;
classifying the email message as spam or non-spam based on a spam filter or user feedback;
updating a probability ratio by applying a sequential probability ratio test, wherein the sequential probability test uses the approximate probability that an email message transmitted by a machine on the network is spam if the computer is compromised and the approximate probability that an email message transmitted by the machine is spam if the computer is not compromised, whereby the probability ratio is increased if the email message was classified as spam or decreased if the email message was classified as non-spam, wherein the probability ratio is updated according to the equation
Λ
n
=
ln
⁢
θ
1
θ
0
,
responsive to the email message being classified as spam;
wherein Λn the probability ratio, θ0 represents the probability that an email message received from a machine on the network is spam given that the machine is not compromised, and θ1 represents the probability that an email message received from a machine on the network is spam given that the machine is compromised;
indicating the status of the machine as compromised, responsive to the probability ratio being greater than or equal to a first predetermined threshold (B);
indicating the status of the machine as normal and resetting the probability ratio, responsive to the probability ratio being less than or equal to a second predetermined threshold (A);
repeating, for a plurality of email messages, the operations of receiving an email message, classifying the email message, updating the probability ratio, and indicating the machine is normal or compromised until the probability ratio is greater than or equal to the first predetermined threshold, wherein the repeated operations are performed on each of the plurality of email messages one at a time as each of the plurality of email messages is received; and
identifying the machine indicated as compromised to a system administrator whereby the compromised machine may be cleaned.

### Claim 2 (depends on 1)

The method of claim 1, wherein the email message originates from the machine.

### Claim 3 (depends on 1)

The method of claim 1, wherein the email message is forwarded by the machine.

### Claim 4 (depends on 1)

The method of claim 1, wherein the spam filter is a content-based spam filter.

### Claim 5 (depends on 1)

The method of claim 1, wherein the email message is classified as spam or non-spam by user feedback.