Patent ID: 8195750

Claim:
A method for tracking a botnet based on statistical data, the method comprising: (a) receiving, from a third party email provider, timestamps, size and source IP addresses for all messages, including any non-spam messages, received from a first sender computer over a time period, without receiving the messages themselves; (b) acquiring, from a third party email provider, statistics for all messages received from the first sender computer over the time period based on analysis of the messages' timestamps, messages' sizes and the messages' source IP addresses; (c) generating a first distribution data representing statistical distribution of the messages received from the first sender computer based on the message sizes and timestamps, the first distribution divided into a plurality of intervals based on the message sizes; (d) receiving, from a third party email provider, timestamps, size and source IP addresses for all messages, including any non-spam messages, received from a second sender computer over the time period, without receiving the messages themselves; (e) acquiring, from a third party email provider, statistics for all messages received from the second sender computer over the time period based on analysis of the messages' timestamps, messages' sizes and the messages' source IP addresses received from the second sender computer; (f) generating a second distribution data representing statistical distribution of the messages received from the second sender computer based on the message sizes and timestamps, the second distribution divided into a plurality of intervals based on the message sizes; (g) approximating the first and the second distribution data by applying an approximating step function to the distribution data, wherein the approximating step function replaces a number of values within the first and the second distributions by a representative value; (h) comparing the approximated distribution data and calculating a degree of coincidence of the distribution data based on a distance between the two approximating step functions; and (i) determining if the first and the second sender computers belong to a botnet based on the degree of coincidence.