Dirk Ourston

US Patent:

7873998, Jan 18, 2011

Filed:

Jul 19, 2005

Appl. No.:

11/184941

Inventors:

Mark L. Wilkinson - Austin TX, US
Dirk Ourston - Dripping Springs TX, US

Assignee:

Trustwave Holdings, Inc. - Chicago IL

International Classification:

G08B 23/00
G06F 15/173

US Classification:

726 22, 726 13, 726 14

Abstract:

A method, system, apparatus, and computer-readable medium to detect rapidly propagating threats in a network. A rapidly propagating threat is detected by capturing a series of packets as the packets are communicated to nodes of the organizational network. The rapidly propagating threat can be detected without relying upon a known signature for the threat. Behavior of nodes when sending and receiving packets is examined for patterns typical of worm propagation.