Patent ID: 8250645
Filing Date: 2012-08-21
Classification: G06F,H04L

Abstract:
1. A method of identifying clients sharing a common access switch in a local area network suspected of being infected with malware, the method comprising: examining header data of protocol data units (PDUs) at the common access switch; determining a PDU type and client address for each PDU based on the header data; for individual clients of the common access switch, maintaining a plurality of counters for providing PDU count values based at least partially on the PDU type; providing a limits table with preset limits corresponding to each count value, a rules set that defines attack patterns for the common access switch, and at least one further limit; and selectively identifying clients of the common access switch that are suspected of being infected with malware based at least in part on the count values, the limits table, and the rules set, wherein identifying suspected clients includes performing a mathematical computation using two or more count values to derive a result, and comparing the result to the further limit.