At&t Intellectual Property I, LP

At+t Corp.

Carl Brian Rexroad

Daniel F Hurley

David Gross

Anestis Karasaridis

David Hoeflin

Willa Kay Ehrlich

Duncan Kirkwood Sparrell

Michael Singer

James Boxmeyer

Jeanette LaRosa

Myra E Agostino

A method and apparatus for detecting compromised host computers (e.g., Bots) are disclosed. For example, the method identifies a plurality of suspicious hosts. Once identified, the method analyzes network traffic of the plurality suspicious hosts to identify a plurality suspicious hub-servers. The method then classifies the plurality of candidate Bots into at least one group. The method then identifies members of each of the at least one group that are connected to a same controller from the plurality suspicious controllers, where the members are identified to be part of a Botnet.

Method and apparatus for detecting compromised host computers

A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate. In turn, the present method raises an alarm if the traffic aggregate's traffic share ratio to be evaluated exceeds or falls below the traffic share ratio threshold defined for the traffic aggregate.

Method and apparatus for volumetric thresholding and alarming on internet protocol traffic

A method and apparatus for providing network traffic composite graphs for packet networks are disclosed. The graph enables analysts to visually determine the relative size of an event in relation to other traffic activity. For example, a user or a network analyst creates categories of applications for the river-chart graph and optionally enters a weight factor for each of the application categories. The method then gathers records for flows, number of bytes (or packets), etc. from monitoring device(s) in a predetermined interval. The expected values are determined and composite volumes are calculated for each protocol and/or port. The method then updates the cumulative river-chart bands and the cumulative expected values for historical and predicted time periods in the river-chart graph.

Method and apparatus for providing a network traffic composite graph

A method and apparatus for generating a reconnaissance index for a communications network is described. In one embodiment, scan detection data is initially received. A number of scan flows and a number of unique source Internet protocol (SIP) addresses initiating said number of scan flows is then identified from said scan detection data. Afterwards, a reconnaissance index is generated by utilizing said number of scan flows and said number of unique SIP addresses.

Method and apparatus for generating a reconnaissance index

Growing community of inventors

Oak Ridge, NJ, United States of America

Carl Brian Rexroad