Propagation of malicious code through an information technology network

• US 20110173675A9
• Filed: 07/26/2006
• Published: 07/14/2011
• Est. Priority Date: 04/28/2004
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Smith, Richard, Norman, Andrew, Griffin, Jonathan
• Application Number:
  US11/494,291
• Publication Number:
  US 20070083914A1
• Time in Patent Office: Days
• US Class Current: 726/003
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method of restricting transmission of data packets from a host entity in a network, comprising: transmitting outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records; over the course of repeated predetermined time intervals, restricting, to a predetermined number, destination hosts not identified in the working set and to which packets may be transmitted; deleting packets whose transmission has been restricted.

Claims

1. A method of restricting transmission of data packets from a host entity in a network, comprising:

transmitting outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records;

over the course of repeated predetermined time intervals, restricting, to a predetermined number, destination hosts not identified in the working set and to which packets may be transmitted;

deleting packets whose transmission has been restricted.

2. A method according to claim 1 further comprising the steps of maintaining a log of destination host identities identified in deleted packets.

3. A method according to claim 2, wherein, in each time interval in which less than the predetermined number of destination hosts which are not identified in the working set have had packets transmitted to them, deleting, from the log, a number of destination host identities equal to the difference between the predetermined number and the number of destination host identities to which packets have been transmitted during that time interval.

4. A method according to claim 3, further comprising the step, prior to deletion of a destination host identity, of adding the destination host identity to be deleted to the working set.

5. A method according to claim 2 wherein addresses are added to the working set and then deleted from the log in temporal order, the oldest-logged addresses being deleted first.

6. A method according to claim 1 wherein deletion of the packet occurs at the end of the time interval in which it is received.

7. A method according to claim 5 wherein deletion of the packet occurs before the end of a time interval in which it is received.

8. A method according to claim 1 comprising the step of adding to the working set, in each time interval, one or more destination host address which are deleted from the address log.

9. A method according to claim 1 wherein the host entity is selected from the group consisting of:

a computer;

a virtual computing environment partitioned from another virtual operating environment;

an applications program.

10. A computer program product adapted to restrict transmission of packets from a host computing entity in a network, the program being adapted to:

permit transmission of outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records;

over the course of repeated predetermined time intervals, restrict, to a predetermined number, destination hosts not identified in the working set and to which packets may be transmitted; and

delete packets whose transmission has been restricted.

11. A computer program according to claim 10, further adapted to maintain a log of destination host addresses identified in deleted packets, and, in each time interval in which less than the predetermined number of destination hosts which are not identified in the working set have had packets transmitted to them, delete, from the log, a number of destination host identities equal to the difference between the predetermined number and the number of destination host identities to which packets have been transmitted during that time interval.

12. A computer program according to claim 11 further adapted to delete the packet at the end of the time interval in which it is received.

13. A computer program according to claim 11 further adapted to delete the packet before the end of a time interval in which it is received.

14. A network of interconnected computing entities, each entity in the network being capable of sending packets to at least one other entity via a hierarchy of programs implementing a hierarchy of networking protocols, the hierarchy containing a further program which throttles transmission of malicious code, the further program being adapted to:

permit transmission of outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records;

over the course of repeated predetermined time intervals, restrict, to a predetermined number, destination hosts not identified in the working set and to which packets may be transmitted; and

delete packets whose transmission has been restricted.

15. A network according to claim 14, the program being further adapted to maintain a log of destination host identities identified in deleted packets.

16. A network according to claim 15, the program being further adapted, in each time interval in which less than the predetermined number of destination hosts which are not identified in the working set have had packets transmitted to them, to delete, from the log, a number of destination host identities equal to the difference between the predetermined number and the number of destination host identities to which packets have been transmitted during that time interval.

17. A computer which is operably connected to one or more other computers, the computer being adapted to restrict transmission of data packets to the other computers in the following manner:

permit transmission of outgoing packets to other computers which are identified in a record stored in a working set of computer identity records;

over the course of repeated predetermined time intervals, restrict, to a predetermined number, other computers not identified in the working set and to which packets may be transmitted; and

delete packets whose transmission has been restricted.

18. A computer according to claim 17, wherein the computer is adapted to maintain a log of the other computers identified in deleted packets.

19. A method according to claim 18, wherein the computer is adapted, in each time interval in which less than the predetermined number of other computers which are not identified in the working set have had packets transmitted to them, to delete, from the log, a number of other computers'"'"' identities equal to the difference between the predetermined number and the number of other computers to which packets have been transmitted during that time interval.