Patent ID: 8127356

Claim:
A computer program product for automatically determining if a packet is a new, exploit candidate, the computer program product comprising: a computer-readable tangible storage device; first program instructions to determine if the packet is a known exploit; second program instructions to determine if the packet is addressed to a broadcast IP address of a network; third program instructions to determine if the packet is network administration traffic; fourth program instructions, responsive to the packet being a known exploit OR the packet being addressed to a broadcast IP address of a network OR the packet being network administration traffic, to determine that the packet is not a new, exploit candidate; and fifth program instructions, responsive to the packet not being a known exploit AND the packet not being addressed to a broadcast IP address of a network AND the packet not being network administration traffic AND the packet not being another type of traffic known to be benign, to determine and report that the packet is a new, exploit candidate; and wherein the first, second, third, fourth and fifth program instructions are stored on the computer-readable tangible storage device.