Patent ID: 8539581

Claim:
A network device comprising: a network probe circuit for collecting information from at least one node of a plurality of networked nodes; a network analyzer circuit for monitoring the plurality of networked nodes including at least generating at least one topological map including the plurality of networked nodes; a decision circuit for determining from the information collected existence of at least one signature or anomaly that indicates at least some malware is operating on the at least one node of the plurality of networked nodes; and a distribution circuit for communicating, in response to determining from the information collected existence of at least one signature or anomaly that indicates at least some malware is operating on the at least one node of the plurality of networked nodes, at least one malware countermeasure to the at least one node of the plurality of networked nodes, the at least one node of the plurality of networked nodes selected using at least one hit list, the at least one hit list based at least partially on at least one generated topological map.