Patent ID: 8677480

Claim:
A computer-implemented method, comprising: by operation of a routing device, distributing information about potential anomalies in a network, comprising: detecting matching packets with payloads that match an anomaly signature; gathering address dispersion information for the matching packets, the address dispersion information providing an indication of a number of different addresses of the matching packets, wherein the different addresses comprise at least one of source addresses and destination addresses; upon determining the address dispersion information indicates the number of different addresses of the matching packets exceeds a distribution threshold, requesting address dispersion information for the matching packets by distributing the address dispersion information for the matching packets to one or more peer nodes; responsive to the request, receiving, from a peer node, additional address dispersion information for packets matching the anomaly signature; aggregating the additional address dispersion information with the gathered address dispersion information; upon determining the aggregated address dispersion information indicates the number of different addresses of the matching packets exceeds a detection threshold, reporting the anomaly signature as a probable anomaly; and propagating the aggregated address dispersion information to one or more peer nodes.