Patent ID: 8341740

Claim:
A method of identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, the method comprising: constructing a current measurement period list of enterprise hosts to or from which each given host of an enterprise network sent or received packets within a current measurement period; accumulating statistics based on two or more measurement period lists; deriving a count value from the accumulated statistics for monitored hosts of the enterprise network, each count value being indicative of the number of other hosts of the enterprise network to or from which each given monitored host of the enterprise network sent or received packets; selectively excluding one or more hosts that serve as email servers. web proxies, or NTP servers from the monitored hosts of the enterprise network; and selectively identifying one or more monitored hosts of the enterprise network for which the count value exceeds a threshold value as suspected of being infected with slow and/or distributed scanning malware.