Patent ID: 7768911

Claim:
A computer-implemented method, comprising: processing, via a processor, network traffic using a multi-timescale heuristic having multiple simultaneous traffic windows, wherein each traffic window has a respective threshold value and a respective timescale defining a period of time for the traffic window after which a counter for the traffic window is reset and wherein at least one traffic window is used to run multiple different heuristics; wherein the processing includes counting unique destination IP addresses within a traffic window, and comparing the number of unique destination IP addresses against the threshold value for the traffic window; and the processor generating an action if the heuristic determines that a threshold value has been exceeded, wherein the action comprises at least isolating a host system from the network during which the host system maintains an out-of-band (OOB) communications channel, as well as throttling of the network connection and the agent operates independently of the operating system so that the self-isolation functionality is available whether or not the operating system is loaded and whether or not the operating system is functional or compromised.