Patent ID: 8095981

Claim:
A system for detecting stealth worms at a port of a network element (NE) connected in a data network, the system comprising: a header data processing unit that extracts destination address data from a header of a protocol data unit (PDU); a timing unit that establishes N non-overlapping timing windows T k , where k is a value between 1 and N, for measurement of a plurality of N destination address sets B k , wherein each destination address set B k comprises a set of Boolean values indicating whether a source NE sent PDUs to a destination NE within each timing window T k ; a memory unit that stores a pooled benchmark A k that provides a total number of expected destination NEs in the data network to which the source NE sends PDUs during each of k non-overlapping timing windows T k ; a set collector unit that determines, for each of N non-overlapping timing windows T k , a pooled destination address X k based on the plurality of N destination address sets B k that provides a total number of destination NEs in the data network to which the source NE sent PDUs during each of the k non-overlapping timing windows T k ; and an attack identification unit that identifies a worm attack based on a comparison of a set of pooled destination addresses X k and a set of pooled benchmark addresses A k .