Patent ID: 7936682

Claim:
A method for detecting malicious attacks, the method comprising: obtaining routing information from a packet communicated via a network, the routing information including a source address and a destination address; maintaining a count of packets associated with a device associated with the routing information; identifying the device as a potentially malicious device when the count exceeds a threshold; mapping the source address obtained from the packet into a source infected set and mapping the destination address obtained from the packet into a destination infected set, the mapping comprising: investigating if the source address is in the source infected set: investigating if the source address is also in the destination infected set: investigating if the destination address is in the destination infected set: incrementing an infection count by at least unity when the source address is not in the source infected set and the source address is in the destination infected set: and adding the source address to the source infected set and adding the destination address to the destination infected set; checking for the presence of an address in the sets; and selectively categorizing a source device associated with the packet as a suspicious device.