Patent ID: 8166544
Filing Date: 2012-04-24
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for facilitating host malware detection, the method comprising: a) determining, by a communications network device that passively monitors one or more network links between (A) a host and (B) at least one peer of the host, a baseline set of response time information for each of one or more types of transactions, wherein the response time information indicates a time including a delay between the host receiving a particular type of message from the at least one peer of the host and the host responding to the particular type of message, and wherein the communications network device is (A) a separate and distinct network entity from the host and the at least one peer of the host, and (B) included in or attached to one of a network switch, a network router, or a network hub; b) determining, by the communications network device, a later set of response time information for each of the one or more types of transactions indicating a time including a delay between the host receiving a particular type of message from at least one peer of the host and the host responding to the particular type of message; c) determining, by the communications network device, whether or not host slowdown has occurred by comparing the baseline set of response time information for at least one of the one or more types of transactions and the later set of response time information for the at least one of the one or more types of transactions; and d) controlling the execution of a host malware protection policy using at least the determination of whether or not host slowdown has occurred.