Patent ID: 7908657
Filing Date: 2011-03-15
Classification: G06F,H04L

Abstract:
1. A method for detecting a variant of a known threat comprising: electronically identifying on a network, using at least one processor, a portion of network traffic similar to at least a portion of a signature associated with the known threat, the known threat indicating an attempted network intrusion; determining an extent of match between the portion of network traffic and the at least a portion of the signature, wherein each portion of the signature is assigned a weight for a possible occurrence of a match between the portion of network traffic and the at least a portion of the signature, wherein at least one combination of portions of the signature is assigned a weight multiplier based upon a possible nature of a match between the portion of network traffic and the at least a portion of the signature, wherein the extent of match comprises a cumulative score that is calculated based upon one or more scores associated with the weights of one or more signature portions and one or more scores associated with the weights of one or more combinations of signature portions that are multiplied by one or more of the weight multipliers; determining that the extent of match satisfies a threshold; and triggering an electronic security response based at least in part on the determination that the extent of match satisfies the threshold; wherein the portion of network traffic being matched with the at least a portion of the signature does not exactly match the at least a portion of the signature.