Patent ID: 9060018
Filing Date: 2015-06-16
Classification: G06F,H04L

Abstract:
1. A computer-implemented method, comprising: receiving data traffic information on communications between a set of internal computers with a set of external computers, wherein the set of internal computers are located within a network, and the set of external computers are outside the network; parsing the received data traffic information to identify communication links between the internal computers and the external computers, each communication link comprising an act by an internal computer to communicate with an external computer or an act by an external computer to communicate with an internal computer; determining a communication link profile for each of the internal computers, the communication link profile for a given internal computer comprising a representation of a subset of external computers that share at least one communication link with the given internal computer; grouping the internal computers into computer clusters based on similarities in communication link profiles for each internal computer, wherein computers having communication link profiles that reach a threshold level of similarity are grouped into a same cluster, and wherein each computer cluster comprises a subset of internal computers communicating with a set of external computers at a frequency that is different from a frequency of communication between other internal computers and other external computers; determining that communication link profiles associated with internal computers in a first computer cluster deviate from communication link profiles associated with internal computers that are not included in the first computer cluster by more than a specified threshold deviation value; and identifying the first computer cluster as including internal computers having communication link profile patterns indicative of a malware attack based on the determination that communication link profiles associated with internal computers in the first computer cluster deviate from communication link profiles associated with internal computers that are not included in the first computer cluster by more than the specified threshold deviation value.