Patent ID: 8234503

Claim:
A method for maintaining computer security, comprising: detecting a connection failure, wherein a potentially-infected machine attempts to connect to a target machine through a router, and wherein the connection failure is identified by a ICMP destination unreachable message, and wherein the ICMP destination unreachable message comprises a destination address and a corresponding source address, the destination address identifying the potentially-infected machine; storing information relating to the connection failure with information relating to previous connection failures, the stored information including, for each destination address, a timestamp, a corresponding source address, and a destination port for the corresponding source address; removing from storage at least a portion of the information relating to the previous connection failures if it is determined that the at least a portion of the information relating to the previous connection failures has been stored for a predetermined period of time; determining a number of stored connection failures; determining whether a machine is potentially infected with malicious code based on the determined number of stored connection failures; and identifying an infection and a targeted service based on the stored information in response to determining that a machine is potentially infected with malicious code.