Patent ID: 8578479

Claim:
A computer program product residing on a non-transitory computer readable storage medium for intrusion detection in a network, the computer program product comprising instructions for causing a processor to: generate an initial signature for a computer worm by identifying a set of bits representing the computer worm; determine if devices in the network are capable of filtering traffic using the generated initial signature; in response to determining that the devices in the network are not capable of filtering traffic using the generated initial signature, discard the generated initial signature; and in response to determining that the devices in the network are capable of filtering traffic using the generated initial signature, generate a first worm signature based on the generated initial signature, the first worm signature formatted for a first device; and generate a second worm signature based on the generated initial signature, the second worm signature formatted for a second, different device, with the first worm signature and the second worm signature being different.