Patent ID: 7490355

Claim:
A method of detecting network worms, comprising: profiling connection information of a protected network to generate connection parameters and connection status values; clustering the connection profile of the connection parameters and the connection status values to generate a plurality of clusters; extracting cluster parameters from the generated clusters and computing attempt measures of the clusters; determining whether any of the clusters is an anomaly cluster; correlating the newly generated anomaly cluster with an existing cluster graph and adding it into the cluster graph if the correlation is successful or establishing a new cluster graph with the newly generated anomaly cluster if the correlation is unsuccessful, each of the cluster graph being appended with its status and a propagation measure; determining whether a worm propagation activity is going on for cluster graphs that satisfy a specific propagation condition; eliminating a cluster graph that does not satisfy the propagation condition within a first predetermined time; and claiming the ending of the worm propagation activity of a cluster graph that does not have new cluster added to it within a second predetermined time.