Cisco Technology, Inc.

Saumyavapuh Lugani

Snigdhendu Mukhopadhyay

Chui-Tin Yen

Sumeet Singh

Rajiv Raghunarayan

Kuntal Daftary

Embodiments of the present disclosure provide techniques for distributing information about possible anomalies in a network. A sensor in a network may detect packets with payloads that match an anomaly signature. Address dispersion information, for example, in the form of source and address bitmaps, may be gathered at the sensor. The address dispersion information may be distributed to one or more peer sensors if the information indicates that the number of different addresses of the detected matching packets exceeds a threshold.

Anomaly information distribution with threshold

A method is disclosed for distributed detection of botnets via a plurality of sensors on a network. According to embodiments, DNS information, including domain names and addresses, is received at a sensor, the number of unique subnets corresponding to a domain name is determined and an alert is sent to other sensors when the number of unique subnets exceeds a first threshold. Other embodiments are also disclosed.

Growing community of inventors

San Jose, CA, United States of America

Saumyavapuh Lugani