Patent ID: 8161555

Claim:
A method for identifying a controller associated with a network attack of an attacked computer comprising: examining a first plurality of traces generated by a previously targeted computer to identify a first plurality of computers associated with the first plurality of traces; storing in a database data corresponding to the first plurality of traces and the first plurality of computers; examining a second plurality of traces generated by the attacked computer to identify a second plurality of computers associated with the second plurality of traces; identifying a third plurality of computers based on a comparison of the data and the second plurality of traces, where the third plurality of computers comprises at least one computer that is also one of the first plurality of computers and also one of the second plurality of computers; redirecting traffic being transmitted to the third plurality of computers transparently through a monitoring complex separate from the attacked computer, such that all traffic directed to each particular one of the third plurality of computers is transmitted through the monitoring complex to the particular one of the third plurality of computers to which the traffic was directed; identifying internet relay chat messages being transmitted via a control channel to each of the third plurality of computers, based on a response of the monitoring complex to the traffic; redirecting the internet relay chat messages being transmitted via the control channel to each of the third plurality of computers transparently through the monitoring complex, such that the internet relay chat messages being transmitted via the control channel to each particular one of the third plurality of computers is transmitted through the monitoring complex to the particular one of the third plurality of computers to which the traffic was directed; and detecting the controller based on a MultiProtocol Label Switching label and a response of the monitoring complex to the internet relay chat messages.