Propagation of viruses through an information technology network

1. A method of monitoring propagation of viruses by a first host within a network of hosts, the method comprising the following steps carried out by the first host:

establishing a record which is at least indicative of identities of destination hosts within the network to whom data has been sent by a first host;

during a first time interval, comparing (a) identities of destination hosts identified in requests to send data from the first host and (b) identities of destination hosts identified in the record;

transmitting all requests to send data; and

storing in a buffer data relating to requests which identify a destination host not in the record, wherein the record is established by monitoring identities of destination hosts to whom requests have been transmitted during a second time interval, which precedes the first time interval.

2. A method according to claim 1 , wherein the record contains a predetermined maximum number of destination host identities, the maximum number being defined in accordance with a policy.

3. A method according to claim 2 , wherein the policy additionally defines a maximum number of destination host identities not in the record, to whom requests may be legitimately transmitted in accordance with the policy.

4. A method according to claim 3 further comprising the step, at the end of any given time interval, of deleting from the buffer data relating to requests transmitted during the given time interval in accordance with the policy.

5. A method according to claim 4 further comprising the step, at the end of the given time interval, of updating the record to reflect identities of hosts identified in requests which are transmitted in accordance with the policy during the given time interval.

6. A method according to claim 5 further comprising the step of updating the record to reflect the identity of the predetermined maximum number of destination host identities to whom data has most recently been sent in accordance with the policy.

7. A method according to claim 1 , wherein the stored data is offered in the buffer and includes a copy of a socket created to send data in accordance with a request.

8. A method according to claim 7 wherein the socket enables identification of at least one application program at whose behest the socket is created.

9. A method according to claim 1 further comprising the steps of:

determining the value of parameter (“slack”) based upon a number of successive time periods that pass when no new requests are made to send data from the first host to hosts not in the record; and

when slack exceeds a predetermined value, allowing the un-impeded passage of data from the first host to destination hosts not in the record.

10. A method as claimed in claim 9 , wherein slack is determined based upon the number of successive time periods for which the buffer is empty.

11. A method as claimed in claim 9 , wherein slack has a predetermined maximum value.

12. A method as claimed in claim 9 , wherein the value of slack is decremented each time an un-impeded passage of data from the first host to a destination host not in the record is allowed.

13. A method according to claim 9 , wherein the time periods are of equal duration to at least one of the time intervals.

14. A method according to claim 1 further comprising the steps of monitoring the rate of increase in the size of the buffer and, in the event that the rate of increase in the size of the buffer exceeds a predetermined rate, generating a virus warning.

15. A method according to claim 1 further comprising the steps of monitoring the increase in the size of the buffer per time interval and, in the event that the increase in the size of the buffer in any given time interval exceeds the predetermined size, generating a virus warning.

16. A method according to claim 1 further comprising the steps of monitoring the size of the buffer and, in the event that the buffer exceeds a predetermined size for a predetermined number of successive time intervals, generating a virus warning.

17. A method as claimed in claim 1 , further comprising the step of varying with time at least one parameter that defines a state of viral infection and is selected from the group consisting of:

number of destination hosts in the record; and

threshold number of requests identifying destination hosts not in the record.

18. A method as claimed in claim 17 , wherein the at least one parameter is varied as a function of the time of day.

19. A method as claimed in claim 17 , wherein the at least one parameter is varied in response to a perceived threat level.

20. A method as claimed in claim 17 , wherein the at least one parameter is changed between a first set of values and a second set of values at a predetermined rate.

21. A method as claimed in claim 20 , wherein at least one of values of the at least one parameters is randomly changed according to a predetermined probability distribution as a function of time.

22. A method as claimed in claim 1 , further comprising the step of determining at least one parameter that defines a state of viral infection and is selected from the group consisting of:

number of destination hosts in the record; and

threshold number of requests identifying destination hosts not in the record by performing an automated search on a set of data indicative of normal network traffic.

23. A method according to claim 1 further comprising the steps of:

receiving a request to send a multiple recipient email from the first host;

determining the value of a parameter (“mslack”) based upon the number of successive time periods that pass when no multiple recipient emails are sent from the first host;

if mslack exceeds a predetermined value, allowing un-impeded passage of the multiple recipient email.

24. A method according to claim 23 , wherein the multiple recipient email is allowed un-impeded passage if mslack is greater than or equal to the number of intended recipients of the email.

25. A method as claimed in claim 23 , wherein mslack is set to zero after the multiple recipient email has been sent.

26. A method as claimed in claim 23 , wherein mslack has a predetermined maximum value.

27. A method according to claim 23 , wherein the time periods are of equal duration to at least one or more time intervals.

28. A method of operating a first host within a network of a plurality of hosts, the method comprising the following steps carried out by a first host:

over the course of a first time interval, monitoring creation of sockets within the first host to identify destination hosts identified therein;

comparing identities of destination hosts monitored during the first time interval with destination host identities in a record; and

storing data from all sockets which identify monitored destination hosts not in the record, wherein the record identifies a maximum number of destination hosts, the maximum number being determined in accordance with a policy.

29. A method according to claim 28 wherein the stored socket data at least enables identification of the destination host identified therein.

30. A method according to claim 28 wherein the record is established by monitoring creation of sockets during a time interval preceding the first time interval.

31. A method according to claim 28 wherein the policy additionally specifies a maximum number of sockets, each identifying a destination host not in the record, to be legitimately created in any given time interval.

32. A method according to claim 31 wherein at the end of a time interval, socket data containing identities of destination hosts in respect of whom sockets have legitimately been created is deleted.

33. A method according to claim 28 further comprising the step, in the event that the number of socket data items stored exceeds a predetermined value, of storing outgoing packets from the first host.

34. A method according to claim 33 wherein packets having a designated destination IP address are stored.

35. A method according to claim 34 further comprising the step of establishing the predetermined IP address from the stored socket data.

36. A method according to claim 28 further comprising the step, in the event that the number of socket data items stored exceeds a predetermined value, of storing incoming packets to the first host.

37. A method according to claim 36 wherein packets having a designated source IP address are stored.

38. A method according to claim 37 , further comprising the step of establishing the predetermined IP address from the stored socket data.

39. A method according to claim 28 wherein socket data is stored in a buffer.

40. A method according to claim 1 , wherein the step of transmitting all requests comprises transmitting the data related to the requests.

41. A method of monitoring propagation of viruses by a first host within a network of hosts, the method comprising the following steps carried out by the first hosts:

establishing a record which is at least indicative of identities of destination hosts within the network to whom data has been sent by the first host;

during a first time interval, comparing (a) identities of destination hosts identified in requests to send data from the first host and (b) identities of destination hosts identified in the record;

transmitting all requests to send data;

based on the result of the comparing, storing in a buffer data to identify as such those requests which identify a destination host not in the record; and

determining a slack parameter based upon a number of successive time periods that pass when no new requests are made to send data from the first host to hosts not in the record and when the slack parameter exceeds a predetermined value, allowing unimpeded passage of data from the first host to destination hosts not in the record.