Patent Document ID: 8904535
Application ID: 11961062
Patent Flag: 1

Claim One:
1. A worm code containment system, comprising: a computer network including a plurality of interconnected host computers; and a software agent running on each host, each agent being operative to: a) detect, during a detection interval, worm-related scan activity or worm code in the form of sustained connection attempts to distinct destination addresses at a rate faster than a predetermined threshold, b) initiate active containment of a detected worm code, c) act as an alert-sending host to alert at least one other agent at an alert-receiving host that the worm code has been detected, d) perform a time-window vulnerability analysis at the alert-receiving host in response to a received alert to determine if suspicious code causing inbound TCP or UDP connections was received during the past X seconds, with X being equal to the alert-sending host's detection interval, and e) initiate active containment of the suspicious code at the alert-receiving host if the time-window vulnerability analysis cannot prove that the suspicious code is not worm code.