Patent ID: 7472418

Claim:
A method comprising: intercepting inbound traffic on a host computer system; copying the inbound traffic to an inbound traffic memory area, the copying the inbound traffic generating copied inbound traffic; releasing the inbound traffic; intercepting outbound traffic on the host computer system; buffering the outbound traffic in an outbound traffic memory area, the buffering the outbound traffic generating buffered outbound traffic; comparing at least a portion of outbound traffic on the host computer system to at least a portion of inbound traffic on the host computer system, wherein the inbound traffic is received on the host computer system from a source external to the host computer system, and wherein the outbound traffic is generated on the host computer system for transmission from the host computer system to a destination external to the host computer system, and further wherein the at least a portion of the outbound traffic is subsequent in time to the at least a portion of the inbound traffic; determining if malicious code is detected on the host computer system based on the comparing; when malicious code is detected, providing a notification of the malicious code detection; and if malicious code is not detected, releasing the buffered outbound traffic.