Patent ID: 8112801
Filing Date: 2012-02-07
Classification: H04L

Abstract:
1. A method of detecting malware, comprising: a) examining header data in each protocol data unit (PDU) transferred by a port of an access switch to at least identify a set of PDUs transferred from a local network device; b) extracting at least one far-end device address for each PDU of the set of PDUs based at least in part on examination of an address portion of the corresponding header data; c) maintaining fan-out information indicative of a quantity of unique far-end device addresses extracted from the set of PDUs during each of a plurality of consecutive time windows; d) determining a current trend based at least in part on the fan-out information for a current time window; e) comparing the current trend to an expected trend; and f) identifying a suspected malware infection in the local network device when the current trend exceeds the expected trend by a trend threshold.