Patent ID: 8813236
Filing Date: 2014-08-19
Classification: H04L

Abstract:
1. A method for detecting a malicious endpoint in a network, comprising: obtaining, from the network, flows among a plurality of endpoints of the network, wherein the plurality of endpoints comprise servers and clients; assigning, to each of the plurality of endpoints, a pre-identified endpoint threat level specific to each of the plurality of endpoints; assigning, to each of the flows, a pre-identified flow threat level specific to each of the flows; calculating, by a computer processor, for a server and a client in the plurality of endpoints, and based on the pre-identified flow threat level assigned to a flow between the server and the client, a server-to-client (SC) score propagation parameter and a client-to-server (CS) propagation parameter, performing, by the computer processor, iterative score propagation based on a sequence of iterations, comprising: detecting an endpoint of the plurality of endpoints as malicious in response to a corresponding one of the final scores exceeding a pre-determined threshold, wherein the endpoint is not identified as malicious based on the pre-identified endpoint threat level assigned to the endpoint.