Systems and Methods for Computer Worm Defense
First Claim
1. A computer worm defense system comprising:
- a plurality of computer worm containment systems, each computer worm containment system comprisinga worm sensor implemented in a computing device and configured to generate a computer worm identifier for a computer worm propagating within a communication network, the worm sensor comprisingan alternate computer network, communications traffic being filtered from the communication network for analysis by the alternate computer network, the filtered communications traffic being characteristic of the computer worm; and
a controller configured to monitor the alternate computer network, and to determine the computer worm identifier based on anomalous behavior caused within the alternate computer network by the computer worm; and
a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifier from the worm sensor to block the propagation of the computer worm within the communication network.
5 Assignments
0 Petitions
Accused Products
Abstract
A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. In various embodiments, the computer worm may be transported from a production network, where the computer worm is not readily identifiable, to an alternate network in the worm sensor where the computer worm may be readily identifiable. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems.
273 Citations
30 Claims
-
1. A computer worm defense system comprising:
a plurality of computer worm containment systems, each computer worm containment system comprising a worm sensor implemented in a computing device and configured to generate a computer worm identifier for a computer worm propagating within a communication network, the worm sensor comprising an alternate computer network, communications traffic being filtered from the communication network for analysis by the alternate computer network, the filtered communications traffic being characteristic of the computer worm; and a controller configured to monitor the alternate computer network, and to determine the computer worm identifier based on anomalous behavior caused within the alternate computer network by the computer worm; and a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifier from the worm sensor to block the propagation of the computer worm within the communication network. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
16. A computer worm defense method comprising:
-
filtering communications traffic from a communication network, the filtered communications traffic being characteristic of a computer worm; analyzing the filtered communications traffic within an alternate computer network of a computer worm containment system; generating a computer worm identifier based on anomalous behavior caused within the alternate computer network by the computer worm; detecting the computer worm within the communication network; and blocking the propagation of the computer worm within the communication network. - View Dependent Claims (17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29)
-
-
30. A non-transitory machine readable medium having embodied thereon executable code, the executable code being executable by a processor to perform a computer worm defense method comprising:
-
filtering communications traffic from a communication network, the filtered communications traffic being characteristic of a computer worm; analyzing the filtered communications traffic within an alternate computer network of a computer worm containment system; generating a computer worm identifier based on anomalous behavior caused within the alternate computer network by the computer worm; detecting the computer worm within the communication network; and blocking the propagation of the computer worm within the communication network.
-
Specification