Abstract:
One embodiment of an apparatus for monitoring from a first location in a computer network traffic emanating from a source at a second location in the network, the apparatus comprising means at the first location for detecting traffic emanating from the source and means for monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic. This monitoring process can trigger various responses such as the isolation of the source from the network. Other systems and methods are also provided.

Description:
CLAIM TO PRIORITY  
       [0001]     This application claims priority to copending United Kingdom utility application entitled, “METHODS OF, AND APPARATUS FOR, MONITORING TRAFFIC EMANATING FROM A SOURCE IN A NETWORK,” having serial no. GB  0417139 . 3 , filed Jul. 30, 2004, which is entirely incorporated herein by reference.  
       BACKGROUND  
       [0002]     It is common practice to interconnect computers to form networks; the benefits offered-by this approach are widely understood. In addition to computers, a network will typically contain ancillary devices, such as printers and traffic routers, which also have some data processing ability. It is often useful to refer to such devices and computers collectively as data processing machines. In this document, such entities will be referred to simply as “machines.” 
         [0003]      FIG. 1  shows an IP (internet protocol) network, which is a common type of computing network. In an IP network, machines are assigned IP addresses. An IP address is a 32 bit binary number and is usually rendered in decimal form by treating the 32 bit address as four concatenated 8 bit words and converting each 8 bit word into a decimal number in the range 0 to 255, thus producing a sequence of four decimal numbers. An example of an IP address in decimal form is 17.154.11.117.  
         [0004]     In an IP network, traffic can be sent to a particular machine by directing the traffic to the IP address of the machine concerned. However, a machine participating in an IP network may be required to handle network traffic relating to several different tasks at the same time. To cater for situations such as this, it is usual for a machine to differentiate between traffic for different tasks by allocating “port numbers” to the tasks. Thus, rather than describe traffic as passing from one machine to another, it is more usual to refer to traffic passing from a specific port on one machine to a particular port on another machine.  
         [0005]     Certain port numbers are reserved for certain purposes. For example, port numbers  21 ,  25 ,  53  and  80  are reserved port numbers. Port number  80  is reserved for web access. If a machine hosts a web server application, then that application will monitor port  80  for requests from the network for web content. Port  21  is used in a similar manner for file-serving. If a machine hosts a file server application, then that application will monitor port  21  of the host machine for (FTP) file transfer protocol requests. Ports  25  and  53  are used in a similar manner for SMTP (i.e., e-mail) and DNS (domain name service) traffic. A DNS application is responsible for resolving a tendered, human-readable, Internet address (e.g. www.hp.com) into an IP address (or vice versa) or for referring the conversion request elsewhere for completion.  
         [0006]     Traffic travels in and out of the network  10  through a router  12 . Within the network  10 , the machines are arranged in subnets. Two subnets  14  and  16  are shown in  FIG. 1 . Subnet  14  has a router  18  and subnet  16  has a router  20 . Traffic enters and leaves subnet  14  through router  18  and, likewise, traffic enters and leaves subnet  16  through router  20 . The network  10  also includes a switch  22 , to which the three routers  12 ,  18 , and  20  are connected. The switch  22  allows network traffic to pass between the three routers. For example, traffic emanating from subnet  14  and destined for subnet  16  passes out of subnet  14  through router  18  and then through switch  22  to router  20  and then into subnet  16 . It will be appreciated that, in practice, a subnet may include several routers for allowing traffic to pass across the boundary of the subnet. Similarly, a network is, in practice, likely to contain more than one switch in order to provide a desired pattern of connections for allowing traffic to pass between the subnets and the network boundary.  
         [0007]      FIG. 2  shows an example of a subnet. The subnet  23  contains a router  24 , which provides a means for traffic to enter and leave the subnet. The router  24  is connected to a switch  26 , and the switch is connected to four other machines  28 ,  30 ,  32 , and  34 . The four machines  28 ,  30 ,  32 , and  34  can communicate with one another by sending traffic through the switch  26 . Also, the four machines  28 ,  30 ,  32  and  34  can access the router  24  through the switch  26  for the purposes of sending traffic to, and receiving traffic from, the wider network outside the subnet.  
         [0008]     It is normal practice for machines in a subnet of an IP network to be assigned IP addresses which, in binary form, begin with a common sequence of bits followed by a unique (within the subnet, at least) sequence of bits. The common portion of the IP addresses within a subnet is known as the subnet address. For example, if one assumes that the IP address of 17.154.11.117 belongs to a machine in a subnet of 256 members whose IP addresses range from 17.154.11.0 to 17.154.11.255, then the address of the subnet is 17.154.11.  
         [0009]     Traffic within an IP network can be characterized as conforming to a connection-based or connectionless protocol. Both types of traffic can be flowing at the same time. In a connection-based protocol, such as HTTP (hypertext transfer protocol), two intercommunicating machines will establish a logical connection with one another before transmitting data between themselves, the logical connection providing, amongst other things, a mechanism for checking the safe receipt of data that is to be transmitted. A connection is normally established by one machine sending another a packet containing a connection request. In a connectionless protocol, by contrast, there is no coordination between machines prior to sending data between them. RTSP (real time streaming protocol) is an example of a connectionless protocol.  
         [0010]     Associating machines to form a network has certain drawbacks. For example, it may become difficult to control the behavior of a machine in a network, since the machine will, in all probability, be influenced in its behavior by its interactions with other machines in the network. Insofar as certain behaviors may be undesirable to an operator of a machine, certain communications between networked machines are also undesirable. For example, a virus can be regarded as a communication that is sent to a machine to cause a change in the behavior of the machine. The types of behavioral change that are considered undesirable often involve the weakening of the security of a machine, the removal of information from a machine, or the transmission of information away from a machine.  
         [0011]     A virus usually propagates by causing a machine to communicate the virus to one or more other machines. Schemes exist for impeding this propagation. For example, it is possible to use firewalls and other related network access technologies to control the traffic that enters or leaves a network. For example, in the network  10  of  FIG. 1 , a firewall could be installed in the router  12 . In general terms, a firewall examines traffic attempting to cross a network boundary, classifies this traffic as either permissible or impermissible and allows only permissible traffic to cross the network boundary  11 . The criteria used by a firewall to assess this permissibility are normally determined by a human administrator. In practice, a firewall or other network access control technology will not succeed in blocking all of the traffic that such an administrator would wish to block. For example, an administrator may fail to identify a certain type of undesirable traffic to a firewall, perhaps because he is unaware of that type or he is unable to categorize that type to the firewall. This problem is often exacerbated in practice, since networks tend to have more than just a single access point at which traffic can cross the network boundary.  
         [0012]     A genre of mechanisms called throttles can complement firewalls and similar schemes in the control of virus action. A throttle is a mechanism, usually implemented in software, that controls the communications sent out from a machine. In the present document, a machine that is under the control of a throttle will be referred to as a throttled machine and a machine that is not under the control of a throttle will be called an unthrottled machine. In general terms, a throttle monitors the traffic that a machine is attempting to send out and governs the rate at which the machine may send traffic to other machines that are not familiar contacts of the machine. Typically, a throttle will allow a machine to send traffic freely to up to a maximum number F of destinations that are regarded as familiar to the machine and to send traffic to other destinations at up to a maximum rate of R distinct destinations per unit time. By using a throttle, the speed of propagation of a virus can be reduced considerably.  
         [0013]     The failure of a throttle, due to, for example, deactivation or circumvention by a user or a virus, is undesirable since, clearly, a virus, if present, will be able to spread more freely. From a network management perspective, throttle failure is particularly undesirable given that some viruses, such as Nimda, are optimized for determining the addresses that might correspond to machines that neighbor an infected machine inside a network.  
       SUMMARY  
       [0014]     According to one aspect, the present disclosure provides an apparatus for monitoring from a first location in a computer network traffic emanating from a source at a second location in the network, one embodiment of the apparatus comprising means at the first location for detecting traffic emanating from the source and means for monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic.  
         [0015]     The present disclosure also relates to a method of monitoring from a first location in a computer network traffic emanating from a source at a second location in the network, one embodiment of the method comprising a step of detecting at the first location traffic emanating from the source and a step of monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic.  
         [0016]     Thus, embodiments of the present disclosure provide a way of monitoring the behavior of a source of network traffic in terms of a characteristic of traffic emanating from the source and facilitates the detection of throttle failure.  
         [0017]     The monitoring of the number, per unit time, of destinations of the traffic lying outside the first set may be achieved with or without knowledge of the membership of the first set.  
         [0018]     If, for example, it is intended that traffic emanating from the source be limited such that, per unit time, the source is not to send traffic to more than the membership of the first set plus a predetermined number of other destinations, then assessment of the actual number, per unit time, of different destinations to which the source sends traffic against the number, per unit time, specified by the limitation allows deductions to be made about the number, per unit time, of destinations of the traffic lying outside the first set. In this scenario, no knowledge of the membership of the first set is required.  
         [0019]     In other embodiments, the monitoring of the number, per unit time, of destinations of the traffic lying outside the first set may require knowledge of the membership of the first set. For example, it is possible to compare destinations of traffic emanating from the source directly with the first set is determine if they lie outside.  
         [0020]     Embodiments of present disclosure may or may not require direct calculation of the number, per unit time, of destinations of the traffic lying outside the first set or the number of destinations outside the first set to which the source sends traffic in a given period of time. As an example of the indirect approach, some embodiments could be arranged to assess the number, per unit time, of destinations of the traffic lying outside the first set by assigning destinations of the traffic lying outside the first set into a second set, depleting the second set at a predetermined rate and examining the size of the second set, e.g. by comparing with a threshold.  
         [0021]     A response may be initiated upon the monitored number, per unit time, of destinations of the traffic lying outside the first set satisfying a predetermined condition. The response may, for example, involve one or more of isolating the source from the network or imposing-a throttle on the source.  
         [0022]     HTTP and some other protocols require that traffic be conveyed between machines through a logical construct called a connection that is established on the basis of a connection request. In order to determine the destinations of traffic emanating from the source and complying with such a protocol, it may suffice to acquire the destinations specified in connection requests emanating from the source.  
         [0023]     Embodiments of the present disclosure can also be implemented as a computer program, conveyed, potentially, by a suitable data carrier.  
         [0024]     Other systems, methods, features, and advantages of the present disclosure will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description and be within the scope of the present disclosure. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0025]     By way of example only, certain embodiments of the present disclosure will now be described with reference to the accompanying drawings, in which:  
         [0026]      FIG. 1  is a block diagram of an IP network;  
         [0027]      FIG. 2  is a block diagram of an embodiment of a subnet within the network of  FIG. 1 ;  
         [0028]      FIG. 3  is a block diagram of an embodiment of a subnet of an IP network that contains a sentinel for monitoring traffic flow;  
         [0029]      FIG. 4  is a block diagram of an alternative disposition of the sentinel shown in  FIG. 3 ;  
         [0030]      FIG. 5  is a flow chart of a traffic monitoring test according to one embodiment of the present disclosure;  
         [0031]      FIG. 6  is a block diagram illustrating the interaction of machines in a network with a DHCP (domain host configuration protocol) server in one embodiment of the present disclosure;  
         [0032]      FIG. 7  is a block diagram illustrating the interaction of machines in a network with a DHCP (domain host configuration protocol) server in another embodiment of the present disclosure;  
         [0033]      FIG. 8  is a block diagram of some machines in a network interacting with a SOCKS server in an embodiment of the present disclosure; and  
         [0034]      FIG. 9  is a flow chart of a traffic monitoring test used in an embodiment of the present disclosure. 
     
    
     DETAILED DESCRIPTION  
       [0035]      FIG. 3  shows one embodiment of a subnet  36  in an IP network. Traffic moves in and out of the subnet  36  through router  38 . The router  38  is connected to a switch  40  that allows traffic to be communicated between the router  38  and various machines within the subnet  36 . In this example, only three other machines  41 ,  42  and  44  are shown connected to the switch  40 , although it will be understood that, in practice, the subnet  38  would most likely contain other devices that are either directly or indirectly connected to switch  40  for communication with the router  38 .  
         [0036]     A sentinel  46  is connected in the path between the switch  40  and the router  38 . The purpose of the sentinel  46  is to assess the behavior of one or more throttled machines within the subnet  36  by scrutinizing connection-based traffic that passes between the switch  40  and the router  38  and hence through the sentinel  46 . The sentinel  46  is effectively another machine in the subnet  36 , with its own resources  48  for data processing and data storage. The sentinel  46  periodically repeats a pervasion test on each throttled machine that it is configured to monitor, although it will be apparent to the skilled person from the following description of the test that it can easily be modified to run on a continuous basis.  
         [0037]     The pervasion test is the same for each machine that is monitored. The pervasion test begins with the sentinel examining any connection requests emanating from the machine that is the subject of the test that pass through the sentinel in an interval of predetermined length T. The sentinel reads the destinations of any such connection requests that are detected and counts the number N of different destinations that are read in the period T (hereinafter N is referred to as the distinct destination count). In the context of an IP network, a “destination” comprises an IP address, possibly in association with the number of a port at the destination machine. The pervasion test ends with a comparison of the number N with a limit L that is specific to the machine under test. If the number N exceeds the limit L, then the sentinel deems the machine under test to be a suspect machine.  
         [0038]     One embodiment of the pervasion test carried out by the sentinel is shown in the flow chart of  FIG. 5 . The pervasion test begins at step S 1 , in which the sentinel looks for a connection request in the traffic that is passing through the sentinel. If no connection request is detected, then the sentinel proceeds to step S 2 , in which the sentinel determines whether or not the time interval T specified for the pervasion test has expired. If the interval has not expired, then the sentinel returns to step S 1 . If the time interval has expired, then the sentinel proceeds to step S 6 . If the sentinel detects a connection request in step S 1 , then the sentinel proceeds to step S 3 , in which the sentinel determines whether or not the detected connection request emanates from the machine that is the subject of the pervasion test. If the connection request does not originate with the machine in question, then the sentinel returns to step S 2 . On the other hand, if the connection request does originate with the machine that is the subject of the pervasion test, then the sentinel proceeds to step S 4 .  
         [0039]     In step S 4 , the sentinel first determines the destination of the connection request and then determines whether or not that destination is present in a set of destinations associated with the machine that is undergoing the pervasion test and which is held in the memory of the sentinel (e.g., at initialization of the pervasion test, the set is placed in an empty state). If the destination is found in step S 4  to be present in the set, then the sentinel returns to step S 2 . On the other hand, if the destination is not present in the set, then the sentinel proceeds to step S 5 , in which the sentinel adds to the destination to the set. From step S 5 , the sentinel returns to step S 2 .  
         [0040]     When the sentinel detects in step S 2  that the time interval T of the pervasion test has expired, the sentinel proceeds to step S 6 . In step S 6 , the sentinel determines whether or not the membership of the set is greater than the limit L. If the membership exceeds L, then the sentinel proceeds to step S 7 , in which the machine undergoing the pervasion test is deemed to be suspect. If the membership of the set does not exceed L in step S 6 , then the sentinel proceeds to step S 8  in which the pervasion test ends. The sentinel will also move to step S 8  from step S 7 .  
         [0041]     The limit L for a particular machine is determined by reference to the characteristics of the throttle that is supposedly applied to that machine. If a throttle dictates that a machine can send traffic freely to a maximum number F of familiar destinations and can send traffic to other destinations at a maximum rate of R distinct destinations per unit time, then the limit to be used when performing the pervasion test on that machine could be set to L=F+RT. However, in practice, the limit L would be set somewhat higher to avoid, for example, falsely concluding that a machine is suspect, when its distinct destination count exceeds F+RT, due to a lack of synchronization between the clock controlling the interval T in the sentinel  46  and the clock controlling the rate R in the machine undergoing the pervasion test.  
         [0042]     Consider the case where machines  41 ,  42  and  44  are supposedly throttled with identical values of F and R, but where machines  42  and  44  have become unthrottled; furthermore, machine  44  has become infected with a virus that causes its host to copy the virus to randomly generated destinations. Performing an iteration of the pervasion test on each of the three machines  41 ,  42  and  44  will produce three respective distinct destination counts N 41 , N 42  and N 44 . In practice, it would be expected that N 42  would be slightly greater than N 41  (to reflect that machine  42  will sometimes send traffic to more than F+RT destinations in a period T) and that N 44  would be much greater than either N 41  or N 42  (due to the much wider variety of destinations targeted by the virus).  
         [0043]     Measurements in a computing network of a typical commercial enterprise have suggested values of N 41 =6, N 42 =6 to 9 and N 44 =50 to 100 where F=5, R=1/sec and T=1 sec. From these results, it is apparent that it is desirable to set the limit L that is to be used with a particular throttled machine to be reasonably close to, but greater than, the value F+RT of that machine, so that throttle failure can be detected even in the absence of virus infection. Returning to the measurements mentioned above, a common limit of L=7 for all three machines would enable sentinel  46  to detect throttle failure in the absence of the virus.  
         [0044]     Once the sentinel has deemed a machine to be suspect, one or more threat responses can be initiated against the machine. Some possible threat responses will now be described using, as an example, the situation where machine  42  has been deemed to be a suspect machine.  
         [0045]     One potential threat response is simply for the sentinel  46  to alert a human administrator of the subnet  36  to the fact that machine  42  is considered to be suspect. The administrator can then decide what other action may be appropriate.  
         [0046]     Another possible threat response is for the sentinel  46  to prevent the machine  42  from sending traffic out on to the subnet  36 . Of course, such a response is dependent upon the existence of suitable functionality within the subnet  36 , in order to allow the sentinel  46  to exert such control over machine  42 . Similar considerations apply to the other threat responses described below.  
         [0047]     A further potential threat response is for the sentinel  46  to initiate the installation of a throttle to control the traffic emanating from machine  42 . The throttle could be installed at the suspect machine  42 , the switch  40 , or the router  38 , or even within the sentinel  46 . Of course, if such a throttle is installed in the sentinel  46  or router  38 , then the throttle will not be able to exert control over all of the traffic emanating from machine  42 , since the sentinel  46  and the router  38  do not have direct access to all of the paths, which may conduct traffic away from the suspect machine. Moreover, it could be futile to attempt to install a throttle at the suspect machine  42 , for example, where the throttle failure has been caused by a virus deactivating the original throttle.  
         [0048]     Another potential threat response is for sentinel  46  to cause the suspect machine  42  to divert its traffic through a throttled machine, so that traffic from the suspect machine  42  comes under the control of a throttle. Some ways of achieving this will now be described.  
         [0049]     It is conventional for a machine to be provided with certain information about an IP network in which it is to participate. Typically, a machine will be provided with subnet and default router identities. A subnet identity is an expression of the IP addresses of a number of machines that comprise a subnet to which a machine belongs. A default router identity is the IP address of a router that is to be the default choice for a machine when sending network traffic across a boundary of a subnet to which that machine belongs.  
         [0050]     Assuming that the machines in subnet  36  utilize subnet and default router identities, the sentinel  46  can initiate the alteration of the subnet and default router identities held by the suspect machine  42 , in order to divert traffic from the suspect machine  42  through a throttled machine. Consider the case where traffic from the suspect machine  42  is to be diverted through a surrogate machine  44  operating a throttle. The sentinel  46  initiates the alteration of the subnet identity held by the suspect machine  42 , so that the subnet contains, from the perspective of the suspect machine  42 , just the suspect machine  42  and the surrogate machine  44 . The sentinel also initiates the alteration of the default router identity held by the suspect machine  42 , so that the surrogate machine  44  becomes the default router of the suspect machine.  
         [0051]     Once these alterations have taken effect, traffic from the suspect machine  42  will only be able to reach the wider network by passing through the surrogate machine  44 . Hence, traffic from the suspect machine  42  will pass under the control of the throttle that is installed on the surrogate machine  44 .  
         [0052]     A DHCP (dynamic host configuration protocol) server provides leases to subservient machines in an IP network. These leases provide the subservient machines with their IP addresses and subnet and default router identities. The leases have a predetermined duration of validity and a subservient machine will be required to apply to its DHCP server for a new lease in anticipation of the expiry of its current lease.  
         [0053]     Consider the case where machine  41  is a DHCP server that is arranged to manage the subnet and default router identities of the suspect and surrogate machines  42  and  44 . The sentinel  46  can be configured to cause the DHCP server  41  to use, henceforth in leases for the suspect machine  42 , a subnet identity defining a subnet of just the suspect and surrogate machines  42  and  44  and a default router identity specifying the surrogate machine  44 . Thus, when the suspect machine  42  next requests a lease from the DHCP server  41 , the subnet and default router identities of the suspect machine  42  will be updated to give effect to the traffic diversion. The process by which this traffic diversion is implemented is outlined in  FIG. 6 . The sentinel  46  sends an instruction RI to the DHCP server  41  requiring the DHCP server to make the desired modifications to the leases that the DHCP server dispenses to machine  42 . At some later time, suspect machine  42  sends a request R 2  to the DHCP server  41  for a new DHCP lease. The DHCP server  41  responds to the request R 2  with a new DHCP lease R 3  containing the desired modifications to the subnet and default router identities to be used by suspect machine  42 .  
         [0054]     It will be appreciated that the time that elapses between the initiation of a traffic diversion of the suspect machine  42  by the sentinel  46  and the implementation of the diversion by the DHCP server  41  will depend, to a certain extent, on the time which has to elapse before the suspect machine needs to apply for a new lease. Obviously, if the DHCP server  41  issues leases with a short duration, then the DHCP server  41  can get a desired traffic diversion in place more quickly.  
         [0055]     Rather than waiting for the implementation of a traffic diversion to be triggered by lease expiry, it is possible to arrange for the sentinel  46  to provoke the suspect machine  42  into obtaining a new lease. This can be achieved by arranging for the sentinel  46  to cause the IP address of a machine that neighbors the suspect machine  42  in the subnet  36  to be made identical to the IP address of the suspect machine. The IP address conflict caused by this change forces the two machines to obtain fresh DHCP leases, at which stage the suspect machine should obtain a lease implementing the desired traffic diversion. Consider the case, as illustrated in  FIG. 7 , where machine  41  is again a DHCP server and the sentinel  46  provokes a subnet address conflict between machines  44  and  42 , the latter machine being the suspect machine.  
         [0056]     The sentinel  46  sends an instruction R 4  to DHCP server  41  instructing the server to make the desired modifications to the leases that are to be dispensed to machine  42 . The sentinel  46  then sends an instruction R 5  to machine  44  requiring machine  44  to alter its IP address, 1  so that it is the same as that of machine  42 . At some later moment in time, machines  42  and  44  detect the fact that their IP address are in conflict and send respective requests R 6  and R 7  to DHCP server  41  for fresh DHCP leases to resolve the conflict. The DHCP server  41  responds to requests R 6  and R 7  by returning new leases R 8  and R 9  to machines  42  and  44 , respectively, at which time machine  42  acquires the subnet and default router identity modifications that are necessary to put the desired traffic diversion in place.  
         [0057]     Another way of creating a traffic diversion to a throttled machine, involving a SOCKS server, will now be described. It is known to deploy a SOCKS server in a network to act as a proxy for a machine when the latter attempts to exchange traffic with a machine lying outside the network. A machine in a network may need a proxy of this kind if the machine is barred under a security policy applied to the network from exchanging traffic with machines outside the network. In order to use a SOCKS server, a machine is provided with a SOCKS shim. A SOCKS shim is a piece of software that identifies attempts by a machine in a network to exchange traffic with machines outside the network and channels such attempts to a predetermined SOCKS server, which will perform the attempts on behalf of the requesting machine.  
         [0058]     Instead of implementing a traffic diversion by altering subnet and default router identities, the sentinel  46  could be arranged to install on the suspect machine  42 , a SOCKS shim that is configured to identify attempts by the suspect machine  42  to communicate with machines outside the network and redirect such attempts to a throttled SOCKS server. Thus, traffic from the suspect machine  42  would become subject to the controlling action of the throttle that is present on the SOCKS server. This process is illustrated in  FIG. 8 , which assumes that machine  41  is a SOCKS server.  
         [0059]     The sentinel  46  sends a communication R 10  to the suspect machine  42 , forcing that machine to install a SOCKS shim. Thereafter, when machine  42  makes an attempt R 11  to communicate with a machine outside the subnet, the communication attempt R 11  is routed to the SOCKS server  41  by the SOCKS shim. Thus, the communication R 11  is subjected to the throttling process that is active within server  41 , before being relayed to its destination as communication R 12 .  
         [0060]     It will be apparent that threat responses other than those described above may be used. It may also be desirable for the sentinel to initiate more than one kind of threat response upon detection of a suspect machine. Clearly, many variations are possible to the scheme outlined with reference to  FIG. 3 . Some of these will now be discussed.  
         [0061]     The process that the sentinel  46  uses to decide whether a machine is suspect can, of course, be varied. In one embodiment, the sentinel  46  does not use the pervasion test and, instead, performs a continuous analysis of the traffic emanating from a machine that is to be evaluated. In this embodiment, the sentinel  46  continuously scans for connection requests from the machine under assessment in the traffic flowing through the sentinel. The sentinel  46  determines if the destinations of any such connection requests that are detected are specified in a “working set” that is maintained by the sentinel for the machine being assessed. If the sentinel  46  fails to find a destination in the working set, then the sentinel will determine if the destination is specified in an “unfamiliar set” that is maintained by the sentinel for the machine under assessment. If the sentinel  46  fails to find a destination in the unfamiliar set, then it will add the destination to that set. The sentinel  46  is arranged to transfer destinations from the unfamiliar set to the working set at a predetermined rate. The working and unfamiliar sets are both organized as FIFO (first in, first out) buffers, of restricted and unrestricted length, respectively. If the sentinel  46  detects that the membership of the unfamiliar set exceeds a predetermined size, then the machine under assessment is deemed to be a suspect machine and the sentinel initiates one or more threat responses against that machine. Specific information about the traffic behavior of the machine under assessment (e.g. limit L) is not required and so unthrottled, as well as throttled, machines can now be scrutinized. The processing steps carried out by the sentinel  46  in this variant are illustrated in the flow chart of  FIG. 9 .  
         [0062]     In step S 9 , the sentinel  46  examines the passing traffic for connection requests. If no connection request is detected, the sentinel proceeds to step S 10 . In step S 10 , the sentinel assesses whether or not it is time to transfer one or more destinations from the unfamiliar set to the working set. If insufficient time has passed, the sentinel returns to step S 9 . Otherwise, the sentinel proceeds to step S 11  in which one or more destinations are transferred from the unfamiliar set to the working set (this transfer being, of course, contingent upon the presence of sufficient destinations in the unfamiliar set). From step  11 , the sentinel returns to step S 9 .  
         [0063]     Upon the detection of a connection request in step S 9 , the sentinel proceeds to step S 12 , in which the sentinel determines whether or not the detected connection request emanates from the machine that is being scrutinized. If the connection request originates from the machine under test, then the sentinel proceeds to step S 13 ; otherwise, the sentinel returns to step S 10 . In step S 13 , the sentinel determines whether the destination of the connection request is present in the working set. If the destination is in the working set, then the sentinel returns to step S 10 ; otherwise, the sentinel proceeds to step S 14 . In step S 14 , the sentinel determines whether the destination is in the unfamiliar set. If the destination is present in the unfamiliar set, the sentinel returns to step S 110 ; otherwise, the sentinel proceeds to step S 15 , in which the destination is added to the unfamiliar set. From step S 15 , the sentinel proceeds to step S 16 , in which the size of the unfamiliar set is scrutinized. If the sentinel determines in step S 116  that the predetermined maximum size for this set has been exceeded, then the sentinel proceeds to step S 17 ; otherwise, the sentinel returns to step S 10 . In step S 17 , the sentinel deems the machine under test to be suspect, and the monitoring process ends.  
         [0064]     When the sentinel  46  operates as described in  FIG. 9 , a further kind of threat response is available. Upon determining that a machine is suspect, the sentinel can continue to maintain the unfamiliar and working sets (e.g., by looping from step S 17  to step S 10 ) and preventing connection requests from travelling to the destinations in the unfamiliar set for as long as those destinations are specified in that set.  
         [0065]     In the arrangement shown in  FIG. 3 , the sentinel  46  is located in the path between the switch  40  and the router  38 . It is, however, possible to site the sentinel elsewhere. For example, in  FIG. 3 , rather than being provided in a dedicated unit, the sentinel could be incorporated in the router  38  or the switch  40 . Since the sentinel does not impede the passage of network traffic, it will not hamper the operation of either the router or the switch. Another possible location for the sentinel is shown in  FIG. 4 .  
         [0066]      FIG. 4  is largely the same as  FIG. 3 , and elements carried over to  FIG. 4  from  FIG. 3  retain the same reference numerals. In  FIG. 4 , the sentinel  46 ′ is located in a branch leading from the path between switch  40  and router  38 . An additional switch  39  is provided in that path and that switch is arranged to copy all of the traffic that it receives from switch  40  or router  38  and to direct the copied traffic to the sentinel  46 ′. In this configuration, the sentinel  46 ′ is capable of performing the same examination of the traffic passing between the router  38  and the switch  40  as before in  FIG. 3 , although it is no longer suitable as a site for implementing a throttle on traffic from a suspect machine, because the sentinel  46 ′ no longer lies in the direct path between the router  38  and the switch  40 .  
         [0067]     It may be the case that a machine being monitored by a sentinel has a tendency to send out, legitimately, traffic to a relatively wide variety of destinations from a certain port. So that such activity does not bias the operation of a sentinel, the sentinel can, in one embodiment, be arranged to ignore traffic from ports of this type within a machine being monitored. There may be other reasons why it would be desirable for a sentinel to examine traffic coming from only a subset of the ports of a machine. In the extreme, the subset could consist of just a single port. Also, it is possible to arrange that multiple versions of a sentinel examine traffic coming from a particular machine. Each version could then be limited to examining traffic stemming from a different subset of the ports of the machine.  
         [0068]     In the embodiments described above, the sentinel monitors destinations of connection-based traffic by scanning for connection requests. Of course, it is possible to arrange that the sentinel alternatively or additionally monitors destinations of connectionless traffic. It will be apparent that many other variants to the schemes described in this document can be conceived.  
         [0069]     It should be emphasized that the above-described embodiments are merely possible examples of implementations, merely set forth for a clear understanding of the principles of the present disclosure. Many variations and modifications may be made to the above-described embodiments without departing substantially from the spirit and principles of the present disclosure. All such modifications and variations are intended to be included herein within the scope of this disclosure.