Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware

1. A method of identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, the method comprising:

constructing a current measurement period list of enterprise hosts to or from which each given host of an enterprise network sent or received packets within a current measurement period;

accumulating statistics based on two or more measurement period lists;

deriving a count value from the accumulated statistics for monitored hosts of the enterprise network, each count value being indicative of the number of other hosts of the enterprise network to or from which each given monitored host of the enterprise network sent or received packets;

selectively excluding one or more hosts that serve as email servers. web proxies, or NTP servers from the monitored hosts of the enterprise network; and

selectively identifying one or more monitored hosts of the enterprise network for which the count value exceeds a threshold value as suspected of being infected with slow and/or distributed scanning malware.

2. The method of claim 1 , wherein constructing the current measurement period list includes creating a fan-out list for each given host of the enterprise network indicating other hosts to which the given host of the enterprise network sent packets within the current measurement period.

3. The method of claim 1 , wherein constructing the current measurement period list includes creating a fan-in list for each given host of the enterprise network indicating other hosts from which each given host of the enterprise network received packets within the current measurement period.

4. The method of claim 1 , further comprising computing the threshold based at least in part on an average of the count values for the monitored hosts of the enterprise network.

5. A system for identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, comprising:

a network element including an electronic processor operatively coupled to an enterprise network and operative to construct a current measurement period list of enterprise hosts of the enterprise network to or from which each given host of the enterprise network sent or received packets within a current measurement period;

a malware detection component operative to accumulate statistics based on two or more measurement period lists from the network element, the malware detection component comprising:

an analysis component operative to derive a count value from the accumulated statistics for one or more monitored hosts of the enterprise network and to selectively exclude one or more hosts that serve as email servers, web proxies. or NTP servers from the monitored hosts of the enterprise network, each count value being indicative of the number of other hosts of the enterprise network to or from which each given monitored host of the enterprise network sent or received packets, and to selectively identify one or more monitored hosts of the enterprise network for which the count value exceeds a threshold value as suspected of being infected with slow and/or distributed scanning malware.

6. The system of claim 5 , wherein the network element is an enterprise switch.

7. The system of claim 6 , wherein the malware detection component is implemented in an enterprise management station operatively coupled with the enterprise switch.

8. The system of claim 5 , wherein the malware detection component is implemented in an enterprise management station operatively coupled with the network element.

9. The system of claim 5 , wherein the network element is operative to create the current measurement period list as a fan-out list for each given host of the enterprise network indicating other hosts of the enterprise network to which the given host of the enterprise network sent packets within the current measurement period.

10. The system of claim 5 , wherein the network element is operative to create the current measurement period list as a fan-in list for each given host of the enterprise network indicating other hosts of the enterprise network from which each given host of the enterprise network received packets within the current measurement period.

11. The system of claim 5 , wherein the analysis component is operative to compute the threshold based at least in part on an average of the count values for the monitored hosts of the enterprise network.

12. A method of identifying enterprise network hosts suspected of being infected with slow and/or distributed scanning malware, the method comprising:

constructing a current measurement period list of enterprise hosts of an enterprise network to or from which each given host of the enterprise network sent or received packets within a current measurement period;

accumulating statistics based on two or more measurement period lists;

deriving a count change value from the accumulated statistics for one or more monitored hosts of the enterprise network, each count change value being indicative of a change in the number of other hosts of the enterprise network to or form which each given monitored host of the enterprise network sent or received packets;

selectively excluding one or more hosts that serve as email servers, web proxies, or NTP servers from the monitored host of the enterprise network; and

selectively indentifying one or more monitored hosts of the enterprise network for which the count change value exceeds a change threshold value as suspected of being infected with slow and/or distributed scanning malware.