Patent ID: 8931099
Filing Date: 2015-01-06
Classification: G06F,H04L

Abstract:
1. A method for identifying a pattern of messages which is characteristic of a malicious intrusion, the method comprising the steps of: a server receiving information identifying a destination IP address, a destination port and a signature of each of a multiplicity of messages having an indicia of a malicious intrusion, and in response, determining a total number of different destination IP addresses, a total number of different destination ports and a total number of different signatures of messages of the multiplicity of messages sent from each of a plurality of source IP addresses during each of a plurality of intervals of substantially the same duration; the server determining that there are (a) a first total number of different destination IP addresses, a second total number of different destination ports, and a third total number of different signatures for the messages sent from one of the source IP addresses during one of the intervals and (b) the first total number of different destination IP addresses, the second total number of different destination ports, and the third total number of different signatures for the messages sent from the one source IP addresses during another of the intervals, and in response in part to repetition of (A) the number of different destination IP addresses for the messages sent from the one source IP addresses during the one and other intervals, (B) the number of different destination ports for the messages sent from the one source IP addresses during the one and other intervals, and (C) the number of different signatures for the messages sent from the one source IP addresses during the one and other intervals, the server determining that the one source IP address has sent a pattern of messages which is characteristic of a malicious intrusion, wherein the indicia of a malicious intrusion comprises a program function that unsuccessfully attempts to complete a TCP/IP three way handshake; and the server determining that the one source IP address is not known to be friendly; and wherein the step of the server determining that the one source IP address has sent a pattern of messages which is characteristic of a malicious intrusion is based in part on the step of the server determining that the one source IP address is not known to be friendly.