Patent ID: 9344442
Filing Date: 2016-05-17
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method, comprising: determining a communication link profile for each of a plurality of internal computers located within a network, the communication link profile for each internal computer comprising a representation of a set of computers that have communicated with the internal computer; grouping the internal computers into computer clusters based on similarities in communication link profiles for each internal computer, wherein computers having communication link profiles that reach a threshold level of similarity are grouped into a same cluster; determining that communication link profiles associated with internal computers in a first computer cluster deviate from communication link profiles associated with internal computers that are not included in the first computer cluster by more than a specified threshold deviation value; and identifying the first computer cluster as including internal computers having communication link profiles indicative of a malware attack based on the determination that communication link profiles associated with internal computers in the first computer cluster deviate from communication link profiles associated with internal computers that are not included in the first computer cluster by more than the specified threshold deviation value.