Patent ID: 8578491

Claim:
A system for network-based detection of malware on a plurality of client computers connected to a network, the system comprising: a network sensor coupled to the network for generating detailed alerts based on one or more received packets including a packet header associated with a client computer of the plurality of client computers, the network sensor reconstructing connection state information based on an asymmetrical traffic flow using acknowledge (ACK) and sequence (SEQ) information in the packet headers of the respective one or more received packets to maintain session state and reassemble a data stream associated with the client computer, the network sensor comprising: a detection engine for detecting the presence of malware on the client computer by comparing data provided within the one or more packets to an alert signature to identify malware behaviour; and an alert generation module for generating an alert when the detection engine detects the presence of malware on the client computer, the alert comprising: a network identifier associated with the client computer; and an identifier associated with the detected malware; an aggregator coupled to the network, the aggregator for translating network identifiers in one or more detailed alerts associated with the client computer to corresponding subscriber identifiers and generating alert summaries based on the alerts and corresponding subscriber identifier; and a reporting infrastructure for receiving the one or more alert summaries and generating one or more subscriber malware notifications.