Patent ID: 7386888
Filing Date: 2008-06-10
Classification: G06F,H04L

Abstract:
1. In a distributed network having a number of server computers and associated client devices, method of isolating infected client devices from uninfected client devices and of inoculating the infected devices, comprising: correlating network related virus infection reports of virus attacks; when a specific number of reports have been correlated, determining if a virus outbreak has occurred based on the correlated information wherein an outbreak has occurred when the number of occurrences of a specified virus has surpassed a threshold; isolating infected client devices from uninfected client devices when the virus outbreak is confirmed; copying by a traffic controller substantially all data packets included in the network traffic; and forwarding the copied data packets to a virus analyzer unit; a controller signaling a virus monitor to switch to inline mode where all data packets are checked for the virus and related viruses without copying of the data packets; monitoring all data packets in the network for the virus; identifying the virus; blocking only packets infected by the particular virus; creating an anti-virus agent, wherein creating an anti-virus agent further includes: