# US 8,752,169 B2 · Botnet spam detection and filtration on the source machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,169 B2 - Document ID: US8752169B2 - Status: Granted - Kind: B2 - Application number: 12/059,877 - Filed: 2008-03-31 - Published: 2009-10-01 - Granted: 2014-06-10 - Earliest claimed: 2008-03-31 - Assignees: Intel Corporation - Applicants: Men Long; David Durham; Hormuzd Khosravi - Inventors: Men Long; David Durham; Hormuzd Khosravi - Web page: https://patentgrep.com/patent/US8752169B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 51/212: using filtering or selective blocking - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 2463/144: Detection or countermeasures against botnets - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and device are disclosed. In one embodiment the method includes determining that a packet attempting to be sent from a first computer system has at least a portion of a human communication message that may contain spam. The method then increments a spam counter when the difference in time between a first time value in a time stamp within the packet and a second time value of a most recent activity from a human input device coupled to the first computer system is greater than a threshold difference in time value. The method also disallows the packet to be sent to a remote location if the spam counter exceeds a spam outbound threshold value. ## Claims ### Claim 1 A method, comprising: determining that a packet attempting to be sent from a first computer system comprises at least a portion of a human communication message that can contain spam; computing a difference in time value by comparing a packet origination time value in a time stamp within the packet and a second time value of a most recent activity from at least one human input device coupled to the first computer system, the most recent activity from the at least one human input device corresponding to the at least one human input device relaying data into the first computer system in response to operation of the human input device by a human; incrementing a spam counter when the difference in time value is greater than a threshold difference in time value; and disallowing the packet to be sent to a location external to the first computer system if the spam counter exceeds a spam outbound threshold value. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending a notification to one or more computer systems external to the first computer system when the spam outbound threshold value has been exceeded by the first computer system. ### Claim 3 (depends on 2) The method of claim 2, further comprising: saving human communication message-related information from the packet that caused the spam email counter to increment; and sending the saved human communication message-related information to the one or more external computer systems with the notification. ### Claim 4 (depends on 1) The method of claim 1, further comprising: attaching a human presence validation receipt to the packet attempting to be sent when the authenticity of the at least one human input device activity has been verified and the local trusted time source time stamp of the at least one human input device activity is not greater than the threshold different in time value from the time stamp within the packet. ### Claim 5 (depends on 4) The method of claim 4, further comprising: indicating to one or more computer systems external to the first computer system receiving the packet that the packet likely contains spam when the human presence validation receipt is not attached to the packet. ### Claim 6 (depends on 1) The method of claim 1, wherein the human communication message is one of an email message, a voice over internet protocol (VoIP) message, a web account registration message, a blog comment message, and a short message service (SMS) message. ### Claim 7 A device, comprising: botnet spam detection technology (BSDT) logic, coupled to a first computer system, the BSDT logic to: determine that a packet attempting to be sent from the first computer system comprises at least a portion of a human communication message that can contain spam; compute a difference in time value by comparing a packet origination time value in a time stamp within the packet and a second time value of a most recent activity from at least one human input device coupled to the first computer system, the most recent activity from the at least one human input device corresponding to the at least one human input device relaying data into the first computer system in response to operation of the human input device by a human; increment a spam counter when the difference in time value is greater than a threshold difference in time value; and disallow the packet to be sent to a location external to the first computer system if the spam counter exceeds a spam outbound threshold value. ### Claim 8 (depends on 7) The device of claim 7, wherein the BSDT logic is further operable to: send a notification to one or more computer systems external to the first computer system when the spam outbound threshold value has been exceeded by the first computer system. ### Claim 9 (depends on 8) The device of claim 8, wherein the BSDT logic is further operable to: save human communication message-related information from the packet that caused the spam email counter to increment; and send the saved human communication message-related information to the one or more external computer systems with the notification. ### Claim 10 (depends on 7) The device of claim 7, wherein the BSDT logic is further operable to: attach a human presence validation receipt to the packet attempting to be sent when the authenticity of the at least one human input device activity has been verified and the local trusted time source time stamp of the at least one human input device activity is not greater than the threshold different in time value from the time stamp within the packet. ### Claim 11 (depends on 10) The device of claim 10, wherein the BSDT logic is further operable to: indicate to one or more computer systems external to the first computer system receiving the packet that the packet likely contains spam when the human presence validation receipt is not attached to the packet. ### Claim 12 (depends on 1) The method of claim 1, further comprising: verifying the authenticity of the at least one human input device activity using a verifiably secure hardware security controller in the first computer system. ### Claim 13 (depends on 12) The method of claim 12, further comprising: stamping the time of the verified at least one human input device activity using a local trusted time source from the hardware security controller. ### Claim 14 (depends on 7) The device of claim 7, further comprising: a verifiably secure hardware security controller; and hardware security controller logic, coupled to the first computer system, to verify the authenticity of the at least one human input activity. ### Claim 15 (depends on 14) The device of claim 14, wherein: the hardware security controller includes a local trusted time source circuit to generate time stamps; and the hardware security controller logic is further operable to stamp the time of the verified at least one human input device activity using the trusted time source.