Platform-based method and apparatus for containing worms using multi-timescale heuristics

1. A computer-implemented method, comprising:

processing, via a processor, network traffic using a multi-timescale heuristic having multiple simultaneous traffic windows, wherein each traffic window has a respective threshold value and a respective timescale defining a period of time for the traffic window after which a counter for the traffic window is reset and wherein at least one traffic window is used to run multiple different heuristics;

wherein the processing includes

counting unique destination IP addresses within a traffic window, and

comparing the number of unique destination IP addresses against the threshold value for the traffic window; and

the processor generating an action if the heuristic determines that a threshold value has been exceeded, wherein the action comprises at least isolating a host system from the network during which the host system maintains an out-of-band (OOB) communications channel, as well as throttling of the network connection and the agent operates independently of the operating system so that the self-isolation functionality is available whether or not the operating system is loaded and whether or not the operating system is functional or compromised.

2. The method of claim 1 , wherein generating an action comprises isolating a platform from the network.

3. The method of claim 1 , wherein generating an action comprises sending an alert notification regarding the exceeded threshold value.

4. The method of claim 1 , wherein monitoring network traffic comprises monitoring Internet Protocol (IP) packet headers.

5. The method of claim 1 , wherein analyzing the network traffic using a heuristic comprises:

grouping destination IP addresses within a traffic window by destination port;

counting unique destination IP addresses for each of the ports; and

comparing the number of unique destination IP addresses for each of the destination ports against the threshold value for the traffic window.

6. The method of claim 1 , wherein analyzing the network traffic using a heuristic comprises:

dividing the network traffic into Transmission Control Protocol (TCP) traffic and User Datagram Protocol (UDP) traffic; and

analyzing the TCP traffic and the UDP traffic separately according to the heuristic.

7. The method of claim 6 , wherein analyzing the TCP traffic comprises:

grouping destination IP addresses within a traffic window by destination port;

counting unique destination IP addresses appearing in TCP synchronize (SYN) requests on each port for each traffic window; and

comparing the number of unique destination IP addresses against the threshold value for each traffic window on the destination port.

8. The method of claim 6 , wherein analyzing the UDP traffic comprises:

grouping destination IP addresses within a traffic window by destination port;

counting unique destination IP addresses on each port for each traffic window; and

comparing the number of unique destination IP addresses against the threshold value for each traffic window on the destination port.

9. The method of claim 2 , wherein isolating the platform from the network if the heuristic determines that a threshold value is exceeded comprises filtering packets to prevent packets sent by the platform from reaching the network.

10. A machine-readable storage medium that provides instructions, which when executed by a machine, cause said machine to:

filter network-bound traffic with an autonomous embedded agent;

copy packet headers of the network-bound traffic to a packet-header cache of an inline processing unit;

receive the copies of packet headers from the packet-header cache,

analyze the packet headers according to one or more multi-timescale heuristics, wherein each multi-timescale heuristic has a plurality of windows of different sizes and each window size has a respective threshold value and wherein at least one traffic window is used to run multiple different heuristics;

send filter rules to the inline processing unit; and

selectively invoke an action based on the analysis, wherein the action comprises at least isolating a host system from the network during which the host system maintains an out-of-band (OOB) communications channel, as well as throttling of the network connection and the agent operates independently of the operating system so that the self-isolation functionality is available whether or not the operating system is loaded and whether or not the operating system is functional or compromised.

11. The machine-readable storage medium of claim 10 , wherein the packet headers are time-stamped.

12. The machine-readable storage medium of claim 10 , further comprising instructions, which when executed by a machine, cause the machine to:

count unique destination IP addresses in the copied packet headers within a window; and

compare the number of unique destination IP addresses against the threshold value for the window.

13. The machine-readable storage medium of claim 12 , further comprising instructions, which when executed by a machine, cause the machine to create filter rules when a threshold is exceeded.

14. The machine-readable storage medium of claim 10 , comprising further instructions that cause a machine to:

group destination IP addresses by destination port;

count unique destination IP addresses in the copied packet headers on each port during a time window; and

compare the number of unique destination IP addresses for the destination port against the threshold value for the traffic window.

15. The machine-readable storage medium of claim 14 , comprising further instructions that cause a machine to create filter rules when a threshold is exceeded.

16. The machine-readable storage medium of claim 10 , comprising further instructions that cause a machine to:

divide the network traffic into Transmission Control Protocol (TCP) traffic and User Datagram Protocol (UDP) traffic; and

analyze the TCP traffic and the UDP traffic separately according to the one or more heuristics.

17. The machine-readable storage medium of claim 16 , comprising further instructions that cause a machine to:

count unique destination IP addresses in the TCP traffic appearing in TCP synchronize (SYN) requests that correspond to a destination port for each window; and

compare the number of unique destination IP addresses against the threshold value for each window on the destination port.

18. The machine-readable storage medium of claim 16 , comprising further instructions that cause a machine to:

count unique destination IP addresses in the UDP traffic that correspond to a destination port for each window; and

compare the number of unique destination IP addresses against the threshold value for the traffic window on the destination port.

19. The machine-readable storage medium of claim 12 , comprising further instructions that cause a machine to generate a notification when a threshold is exceeded.

20. The machine-readable storage medium of claim 14 , comprising further instructions that cause a machine to generate a notification when a threshold is exceeded.