Patent ID: 8079080

Claim:
A method of detecting security threats in a computer network, the method comprising: receiving a data stream which represents outbound, application layer messages from a first computer process to at least one second computer process wherein the computer processes are implemented on one or more computers; specifying at least one legitimate application from which the outbound, application layer messages are considered legitimate; creating a specification of header values that can be generated by the at least one legitimate application; monitoring the data stream using a set of application layer heuristics related to a set of possible legitimate behavior of the at least one legitimate application with respect to a plurality of servers outside the network to detect, outbound, application layer messages that were not generated by the at least one legitimate application wherein the at least one legitimate application is able to communicate to the plurality of servers and wherein the step of monitoring includes the step of detecting messages that contain header values not in the specification thereby indicating a potential security threat wherein the set of heuristics includes at least one of: a first filter that determines if application-layer message header formatting matches that of at least one legitimate application; and a second filter that measures the amount of data in application-layer messages to obtain measurements and compares the measurements to at least one of a single-message threshold and an aggregate threshold, both filters discounting the size of expected fields from the measurements; and generating a signal based on the potential security threat wherein the security threats include communication activity from unwanted software or programs via the outbound application-layer messages.