Patent ID: 8015605

Claim:
A network monitor for malicious network traffic implemented on an electronic circuit executing a stored program, the monitor further comprising: a network interface for receiving at a plurality of addresses malicious communications from at least one malicious computer, each malicious communication comprised of a series of statements, the statements conforming at least in part to a communication protocol defined by a series of communication states; a constrained-state-awareness responder creating, for each given statement of the malicious communication at the plurality of addresses, a response communicated to the at least one malicious computer to the given statement of the malicious communication based on the given statement and a given number of previous statements of the malicious communication less than that required to determine a position of the given statement of the malicious communication within the series of communication states of the communication protocol; wherein the responder creates responses to the malicious computer without accurately determining the communication state of the communication protocol for the given statement of the malicious communication, and wherein the responder cannot fully execute the communication protocol; and a monitor recording the series of statements of the malicious communication for the plurality of addresses.