Patent ID: 7634812

Claim:
An automated containment method comprising: detecting, at a detection module, a specific program vulnerability to a worm; generating and sharing a self-certifying alert, wherein the self-certifying alert is propagated via a self organizing protocol within a system of mutually untrusting computing devices, during one of: a non-attack period and an active worm outbreak utilizing the self-organizing protocol; receiving an independently verifiable self-certifying alert that includes information proving a vulnerability of a program; retrieving a first execution path illustrating the vulnerability of the program exploitable by a worm attack from the self-certifying alert; determining at least one byte in an incoming message which determines at least a portion of the first execution path; determining at least one condition on the determined byte which may be tested to verify the presence of the at least one byte; testing at least a portion of a new message with the at least one condition to detect the presence of a worm attack; and refusing to process the new message based on the test.