Patent ID: 7933946

Claim:
In a distributed computing system, a method of using historical information about data propagation by monitoring HTTP protocol requests to and HTTP protocol replies from a server, the method comprising: receiving a HTTP protocol request from one of a plurality of client systems; identifying that the HTTP protocol request is used to upload data onto a web site; determining that the uploaded data comprises HTML data that includes HTML code; determining an identity associated with the one of the plurality of client systems; creating a tag that uniquely identifies the uploaded HTML data; inserting the tag into the HTML code; mapping the tag and the identity into a propagation graph, which includes nodes and edges associated with a plurality of client systems that made a HTTP protocol request to upload HTML data to the web site, such that each node of the propagation graph corresponds to both a tag and an identity of at least one of the client systems that made a HTTP protocol request to upload HTML data to the web site, and such that edges within the propagation graph represent causality links between the nodes, wherein each node in the propagation graph is configured to store multiple identities, wherein each node has a depth value, which is an approximation of the number of unique identities on the path from that node to the root, and wherein the mapping the tag and the identity into the propagation graph comprises: identifying if a parent node is an only predecessor of a child node to be added with the tag and identity, wherein if true the method further comprises: determining an identity size of one or more storage station nodes that include identity values up to a predefined threshold in the path from the parent node to the root node; assigning a depth value for the child as a sum of determined identity sizes found in the one or more storage stations nodes; copying all identities in the parent node to the child node; adding the child node's identity if it is unique, and when the child node's identity is unique, incrementing the depth value of the child node by one; and marking a tree of the propagation graph associated with the child node and the parent node as infected by a worm if the child node's depth value exceeds some threshold; and using the propagation graph for determining at least an approximation of how many HTTP protocol requests for uploading HTML data to the web site have been made, where one or more of the HTTP protocol requests originated and how the HTTP protocol requests are linked, including determining a longest path in the propagation graph and a number of unique identities in the path.