Patent ID: 9009299
Filing Date: 2015-04-14
Classification: H04L

Abstract:
1. A computer-implemented method for identifying a peer-to-peer bot of a peer-to-peer botnet, the computer-implemented method comprising: a) determining, with a computer system, a candidate set of peer-to-peer bots of the peer-to-peer botnet by: b) storing, on a processor-readable medium, information identifying computers of the candidate set; c) determining, with the computer system and for each candidate computer in the candidate set, a confidence level indicative of a certainty of a membership of the candidate computer in the peer-to-peer botnet; d) determining, with the computer system and for each candidate computer in the candidate set, whether the confidence level of the candidate computer exceeds a determined threshold confidence level; e) identifying, with the computer system, at least one of the candidate computers as a peer-to-peer bot of the peer-to-peer botnet, responsive to a determination that the confidence level of the at least one of the candidate computers exceeds the determined threshold confidence level; and f) taking an action on the identified candidate computers based on a policy, wherein the action comprises monitoring network traffic of the identified candidate computers or executing a diagnostic tool on the identified candidate computers to confirm whether the identified candidate computers are bots.