Patent ID: 8042180

Claim:
A method for combating malicious programs, the method comprising: maintaining a network model representing a normal usage of network resources by a device, the network model predetermined by a user, the network model identifying a predetermined number of packets to be transmitted in a predetermined period of time by the device; monitoring network traffic generated by the device; based on the network traffic that is monitored, identifying an average number of packets actually transmitted in the predetermined period of time by the device; modifying the network model by replacing the predetermined number of packets identified in the network model with the average number of packets actually transmitted by the device; after the modification of the network model, monitoring network traffic from the device; after the modification of the network model, determining that the device is transmitting an observed amount of network traffic that is greater than the average number of packets identified by the network model as modified, the observed amount of network traffic being greater than the average number of packets by a margin of a specified number of standard deviations; and disabling transmission of said network traffic for said device determined to be transmitting the observed amount of network traffic that is greater than the average number of packets by the margin of a specified number of standard deviations.