Patent ID: 7634813

Claim:
An automated containment method comprising: detecting, at a detection module, a specific program vulnerability to a worm; generating and sharing a self-certifying alert, wherein the self-certifying alert is propagated via a self-organizing protocol within a system of mutually untrusting computing devices, during one of: a non-attack period and an active worm outbreak utilizing the self-organizing protocol; receiving, at a receiving computing device, the self-certifying alert independently verifiable by the receiving computing device, the alert comprising a program identifier and an event list, the program identifier identifying a program having a detected vulnerability, and the event list including one or more non-deterministic events which illustrate the detected vulnerability, wherein the program with detected vulnerability is a program subject to one of: injection of harmful code and remote control of the program's execution that has not yet been infected; determining if the receiving computing device includes the program having the detected vulnerability; verifying that the event list illustrates the detected vulnerability independently from a source of the self certifying alert; and protecting, via the detection computing system and the receiving computer from future attacks.