Patent ID: 7917957

Claim:
A system for detecting a slow scan stealth worm attack in a communication network, comprising, on a port of a network element connected in said communication network: means for extracting address data from a header of data packets seen on said port, wherein said extracted address data identifies a destination of said data packets; a destinations number estimating unit for maintaining a cumulative table C i with all destinations to which a specified source in said communication network has sent data packets during a predetermined period of time T i-1 -T 0 , and estimating a number of new destinations counted in a current time window T i based upon detection of destination addresses in a plurality of buckets, wherein each of the destination addresses within a certain set of the destination addresses uses a different bucket based on a hash index from a bucket selector; an attack identification unit for comparing the estimated number of new destinations with an expected number of new destinations, based upon how many new destinations would normally occur during the current time window associated with one of the plurality of buckets, and identifying the slow scan stealth worm attack if said estimated number of new destinations exceeds said expected number by a threshold; and a timing unit for setting a duration of said current time window.