Patent ID: 8291498

Claim:
A method of analyzing abnormal activity in a wide area network, said method comprising: establishing a plurality of virus monitors throughout said wide area network, said wide area network including a plurality of tiers of devices, each of said virus monitors being associated with a lower tier of client devices of said wide area network; monitoring network traffic in said lower tiers of client devices by said associated virus monitors; detecting at least one abnormal event in said network traffic by said virus monitors; sending, from each of said virus monitors of said lower tier that has detected said at least one abnormal event, an event report to a Web server computer, each event report providing information on said corresponding detected abnormal event, wherein said Web server computer is located external to said wide area network of tiers of devices and not being located in traffic flow between said devices and the Internet; analyzing said event reports; generating a virus warning and a mode change command by said Web server computer; downloading said mode change command from said Web server computer to one of said virus monitors, said mode change command directing said one virus monitor to change from a standby mode to an inline mode, wherein said one virus monitor monitors said network traffic by analyzing copied data packets while in said standby mode; and blocking only infected data packets of said network traffic to said lower tier of client devices associated with said one virus monitor by said one virus monitor while in said inline mode without copying data packets for analysis.