Patent ID: 7761919

Claim:
A method for detecting malicious programs within a computer network comprising: monitoring, by a first one of one or more agents within the computer network, at least one first packet of data communicated over said computer network, the first agent comprising a first agent network device; at the first agent, comparing information within the at least one first packet to one or more virus scanning signature files to determine that the information within the at least one first packet does not match one of the one or more virus scanning signature files; in response to determining that the at least a portion of the information in the at least one first packet does not match one of the one or more virus scanning signature files, transmitting, by the first agent comprising the first agent network device, said at least one first packet of data to a master within the computer network, the master comprising a network device in communication with the first agent network device via the computer network; analyzing, by the master, said at least one first packet of data to detect the presence of a malicious program; generating, by the master, a signature of said at least one first packet of data when a malicious program is detected; transmitting the signature from the master comprising the network device to the first agent comprising the first agent network device and at least a second one of the one or more agents, the signature transmitted via the computer network; monitoring, by a second one of the one or more agents, at least one second packet of data communicated over said network; and detecting, by the second agent, evidence of said malicious program in said at least one second packet of data utilizing said generated signature.