Patent ID: 7657625

Claim:
A method comprising: monitoring an Internet Protocol (IP) usage pattern of a first computer system, said monitoring being performed by a second computer system remotely located from the first computer system, wherein the second computer system is associated with an Internet Service Provider (ISP) and the first computer system is associated with a customer of the ISP; determining a baseline model of IP usage for the first computer system; identifying first parasite software at the first computer system based on an abnormal change in the IP usage pattern associated with the first parasite software, wherein the abnormal change in the IP usage pattern is detected by comparing the IP usage pattern to the baseline model of IP usage for the first computer system; forwarding anti-parasite software to automatically mitigate the first parasite software from the ISP to the first computer system; and sending a billing statement from the ISP to the customer of the ISP, wherein the billing statement indicates that the first parasite software was automatically mitigated by the ISP.