Patent Document ID: 8151350
Application ID: 12388170
Patent Flag: 1

Claim One:
1. A worm detecting method comprising the step of: collecting, by a worm detecting device, traffic provided to a network to thus collect passing traffic; generating, by the worm detecting device, a first traffic matrix for showing a characteristic of the traffic in a first time domain beginning at a first time, a second traffic matrix for showing a characteristic of the traffic in a second time domain beginning at a second time that is an end time of the first time domain, and a third traffic matrix for showing a characteristic of the traffic in a third time domain beginning at a third time that is an end time of the second time domain to thus generate a traffic matrix; eliminating by the worm detecting device, a matrix entry corresponding to a legitimate flow in the first time domain, the second time domain and the third time domain, and eliminating a matrix entry corresponding to the flow having ended or started at the exact time of the second time and the flow having ended at the third time from the legitimate flow, and generating a legitimate traffic elimination matrix to thus eliminate legitimate traffic; calculating by the worm detecting device, a rank value of the legitimate traffic elimination matrix to thus calculate a rank value; and determining by the worm detecting device the network state based on the rank value to thus determine a state of the network.