Patent ID: 8006305

Claim:
A computer worm defense system comprising: a plurality of computer worm containment systems, each computer worm containment system including a worm sensor implemented in a computing device and configured to generate a computer worm identifier for a computer worm propagating within a communication network, a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifier from the worm sensor to block the propagation of the computer worm within the communication network, a hidden computer network, and a controller configured to monitor the hidden computer network and to determine the computer worm identifier based on anomalous behavior caused within the hidden computer network by the computer worm; and a management system in communication with the plurality of computer worm containment systems and configured to obtain a computer worm identifier from a worm sensor of a first computer worm containment system of the plurality of computer worm containment systems and distribute the computer worm identifier to a computer worm blocking system of a second computer worm containment system of the plurality of computer worm containment systems.