Patent ID: 8239687

Claim:
A method of tracing the location of an origin computer system that initially transmits a suspect data payload across a computer network to an end target computer system, the computer network having a plurality of computer systems, where each of the computer systems maintains connection records of transmitted data it receives, the transmitted data and connection records including a previous computer system address, a data payload, and a next computer system address, the method comprising: creating, at each of the computer systems, a connection record for each transmission received from another computer system through the computer network; generating and storing a plurality of statistical distributions, wherein each of the plurality of statistical distributions is a byte frequency distribution of data contained in the data payload in the connection record for each transmission received from another computer system through the computer network; selecting a model byte value statistical distribution from a plurality of model byte frequency statistical distributions based on the length of the data contained in the data payload, wherein the model byte frequency statistical distribution is representative of normal payloads transmitted through the computer network; identifying the suspect data payload at the end target computer system based at least in part on differences detected between the statistical distribution associated with the suspect data payload and the selected model byte value statistical distribution and generating a suspect byte frequency distribution of data contained in the suspect data payload; setting the end target computer system as the suspect computer system; comparing the suspect byte frequency distribution of the data contained in the suspect data payload to the plurality of statistical distributions associated with the connection records; upon finding at least one of the plurality of statistical distributions that is similar to the suspect byte frequency distribution of the data contained in the suspect data payload, determining the previous computer system address associated with the at least one of the plurality of statistical distributions; setting the computer system associated with the previous computer system address as the suspect computer system; and repeating the comparing, the determining, and the setting until the origin computer system is determined.