Patent ID: 7784096

Claim:
A method for slowing computer malware from spreading beyond a host computer system, the method comprising: setting an upper bound limit on a total number of concurrent transmission control protocol (TCP) network connection attempts that can be made from the host computer system; and when a connecting process issues a connection attempt and a number of TCP network connection attempts in progress exceeds the upper bound limit: generating a hash value for the connecting process by applying an exclusive “OR” (XOR)-based hash function to an address of a process structure in a kernel of the connecting process; selecting a hash bucket for the connection attempt based on the hash value; queuing the connection attempt in the corresponding hash bucket, wherein connection attempts in the hash bucket are processed in a first-in-first-out (FIFO) order; when a route cache entry (RCE) of the connection attempt is not reachable and does not have an ongoing connection attempt being counted towards an outstanding connection attempt count, marking the RCE as constrained, and incrementing the outstanding connection attempt count; when the connection attempt succeeds, marking the RCE as reachable, and decrementing the outstanding connection attempt count; and when the connection attempt fails in response to an expiration of a predetermined amount of time, marking the RCE unconstrained, and decrementing the outstanding connection attempt count.