Patent ID: 7941853

Claim:
A distributed computer implemented system for detecting eThreats that propagate in a network, which comprises: graphs database within a Central Decision Maker module (CDM) storing in digital form at least one propagation graph, each propagation graph describing the typical propagation over time of one eThreat class or a legitimate executable class within the network; plurality of agents that are distributed in corresponding plurality of host computers within the network, each of said agents continuously monitoring a corresponding host computer and reporting to said Central Decision Maker module the identity of any new suspected executable, and the time in which said suspected executable has been first detected by said agent; said CDM module which comprises: (i) a graph creation unit for receiving all said reports from said plurality of agents, creating from said reports for each suspected executable a corresponding propagation graph which reflects the propagation characteristics over time of said suspected executable within the network, (ii) a comparator for (a) comparing each of said created graphs with said stored at least one propagation graph, (b) upon finding a similarity above a predefined threshold between a created graph and one of the stored graphs, concluding respectively that said executable belongs to the class as defined by said stored graph, and (c) conveying said conclusion to said agents, for optionally taking an appropriate action at the host computers respectively; and wherein, one of the graphs in said database which relates to a worm-type eThreat class has a value of α as a function of time which is constant within a predefined time interval and larger than zero during an initial propagation phase of said executable, and the CDM concludes that the executable is a worm when a similarity above a predefined threshold is found between said created graph and said stored graph which relates to a worm, and wherein α=(number of infected host computers at time t)/(number of infected host computers at time t−1).