Patent ID: 8065731

Claim:
A method for containing propagation of a malware in a communication network having a plurality of communication nodes, comprising: obtaining communication statistics from a traffic trace of the communication network; generating, by a hardware server, a weighted graph from the communication statistics to represent a communication pattern in the communication network, wherein the weighted graph comprises a plurality of vertices representing the plurality of communication nodes and a plurality of edges connecting the plurality of vertices, wherein each vertex of the plurality of vertices is associated with a vertex weight, the vertex weight being determined from a portion of the communication statistics associated with a corresponding communication node of the plurality of communication nodes, wherein each edge of the plurality of edges is associated with an edge weight, each edge connecting two communication nodes of the plurality of communication nodes, the edge weight being determined from a portion of the communication statistics associated with communication between the two communication nodes; partitioning, by the hardware server, the weighted graph based on a first pre-determined criterion into at least a first sub-graph representing a first portion of the communication network and a second sub-graph representing a second portion of the communication network, wherein the first sub-graph comprises a first portion of the plurality of vertices and the second sub-graph comprises a second portion of the plurality of vertices wherein the weighted graph is partitioned based on the first pre-determined criterion such that a first sum of vertex weight associated with the first portion of the plurality of vertices is essentially the same as a second sum of vertex weight associated with the second portion of the plurality of vertices; identifying, by the hardware server, one or more separator edges of the plurality of edges, the one or more separator edges connecting the first sub-graph and the second sub-graph, wherein the weighted graph is partitioned based on the first pre-determined criterion such that a sum of edge associated with the one or more separator edges is minimized; identifying, by the hardware server, a separator vertex from the plurality of vertices of the weighted graph, the separator vertex connecting the first sub-graph and the second sub-graph, the separator vertex representing a separator node of the plurality of communication nodes; and providing a security patch to the separator node for preventing propagation of the malware between the first portion of the communication network and the second portion of the communication network.