Patent ID: 8775521
Filing Date: 2014-07-08
Classification: H04L

Abstract:
1. A method for detecting a zombie attack in a network comprising a plurality of computers, the method comprising: determining, for each particular computer in the plurality of computers, a working set associated with the particular computer, the working set comprising: a first list of email addresses including email addresses associated with emails sent by the particular computer and including email addresses associated with emails received by the particular computer; determining whether at least a first threshold number of computers in the plurality of computers are transmitting email messages to email addresses not included in their working set; determining whether at least a second threshold number of computers in the plurality of computers are transmitting at least a first threshold number of emails to a recipient computer; determining, for each computer in the plurality of computers, whether at least a second threshold number of emails are being transmitted to email addresses not included in its working set; storing, for each particular computer in the plurality of computers, data comprising: determining a change in the rate of emails sent based on the rate and the data; and detecting a zombie attack based on: