Propagation of viruses through an information technology network

• US 9,648,038 B2
• Filed: 05/29/2015
• Issued: 05/09/2017
• Est. Priority Date: 06/07/2002
• Status: Expired due to Term

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Williamson, Matthew Murray, Brawn, John M.
• Primary Examiner(s): Sall, El Hadji
• Application Number:
  US14/725,080
• Publication Number:
  US 20160028747A1
• Time in Patent Office: 711 Days
• Field of Search: 709225, 709206, 709224, 709232, 726 13, 726 27, 726 31
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Requests to send data from a first host within a network of hosts are monitored against a record of destination hosts that have been sent data in accordance with a predetermined policy. Destination host identities (not the record) are stored in a buffer. The buffer size is monitored to determine whether requests from the first host are pursuant to viral activity therein.

Claims

1. A method of operating a host within a network of a plurality of hosts, comprising the steps of:

monitoring requests to send data to other hosts in the network during successive intervals of time; and

for each interval of time, creating (a) a dispatch record for requests which have occurred within the scope of a policy, and (b) a buffer record for requests which have occurred outside the scope of the policy.

2. A method according to claim 1 wherein the dispatch record includes data entries identifying destination hosts to which data has been sent, and a maximum number of entries the dispatch record can contain is defined by the policy.

3. A method according to claim 2 further including periodically-updating the dispatch record to indicate identities of destination hosts to which data has most recently been sent in accordance with the policy.

4. A method according to claim 3 wherein periodic updating of the dispatch record occurs at pretermined time intervals.

5. A method according to claim 4 wherein in each of the time intervals the policy permits data to be sent to a predetermined number of destination hosts which are not identified in the dispatch record.

6. A method according to claim 5 wherein after updating, the dispatch record identifies a predetermined number of destination hosts to which data has most recently been sent in accordance with the policy.

7. A method according to claim 6 wherein updating the dispatch record includes the step of deleting an entry identifying a destination host from the dispatch record and replacing the deleted entry with an entry identifying a destination host to whom data has more recently been sent.

8. A method according to claim 1 wherein the buffer record includes a plurality of entries each identifying a request to send data to destination hosts which are not identified in the dispatch record, each entry in the buffer record identifying the destination hosts in respect of which the request was made.

9. A method according to claim 8 further including periodically updating the buffer record at predetermined time intervals.

10. A method according to claim 9 further comprising the steps of:

upon receipt of a request to send data to a destination host, comparing the destination host'"'"'s identity with destination hosts identified in the dispatch record; and

if the dispatch record does not identify the destination host, adding an entry to the buffer identifying the aforesaid request.

11. A method according to claim 10 further comprising the step of removing a number of entries from the buffer record in accordance with the policy at the end of a time interval, the buffer record thereby providing, following the removal step, a record of requests to send data which are outside the scope of the policy.

12. A method according to claim 11 wherein the policy specifies removal of a predetermined number of entries on a first in, first out basis.

13. A method according to claim 11 further comprising the step of determining whether the aforesaid number is above or below a threshold defining viral infection by monitoring the number of entries identified in the buffer record.

14. A method according to claim 11 further comprising the step of generating a signal in response to an indication that the rate of increase of the buffer record exceeds a threshold value.

15. A method according to claim 8 further comprising the step of inhibiting transmission of any request for which an entry exists in the buffer.

16. A method according to claim 15 further comprising the step of transmitting requests upon removal of their entry in the buffer record at the end of a time interval and in accordance with the policy.

17. A method according to claim 7 further comprising the step of transmitting all requests in the buffer.

18. A method according to claim 8 wherein each entry in the buffer record is a copy of a socket relating to a request in respect of which an entry in the buffer record was made.

19. A method according to claim 1 wherein all time intervals are the same length.

20. A method according to claim 1, further comprising:

when one or more requests in the buffer record have fallen within the scope of the policy in a subsequent interval of time, sending data to the respective destination host in accordance with said one or more requests, entering said one or more requests to the dispatch record, and removing said one or more request from the buffer record.