Patent ID: 8056115
Filing Date: 2011-11-08
Classification: H04L

Abstract:
1. A method for identifying a combination of messages suspected of being malicious, the method comprising the steps of: a computer obtaining an identification of first and second messages sent from a same source IP address to a multiplicity of different destination IP addresses, the first message individually having a first signature characteristic of a first malicious message, and the second message individually having a second, different signature characteristic of a second, different malicious message; the computer determining a frequency with which the source IP address sent both the first and the second messages to any of the multiplicity of destination IP addresses; the computer determining a ratio of a number of the destination IP addresses that received both the first and the second messages to a number of the destination IP addresses that received at least one of the first and the second messages; and responsive to the frequency and ratio being indicatively high factors to suspect that the combination of the first and the second messages forms a malicious combination of messages, the computer making an electronic record that the combination of the first and the second messages is suspected to form a malicious combination of messages.