Detecting dissemination of malicious programs

TECHNICAL FIELD

[0001] The present invention relates to the field of network security, and more particularly to detecting the randomness in destination addresses in order to detect dissemination of malicious programs.

BACKGROUND INFORMATION

[0002] Network security management is becoming a more difficult problem as networks grow in size and become a more integral part of organizational operations. Attacks on networks are growing both due to the intellectual challenge such attacks represent for hackers and due to the increasing payoff for the serious attacker. Furthermore, the attacks are growing beyond the current capability of security management tools to identify and quickly respond to those attacks. As various attack methods are tried and ultimately repulsed, the attackers will attempt new approaches with more subtle attack features. Thus, maintaining network security is on-going, ever changing and an increasingly complex problem.

[0003] One example of a network attack on a network device, e.g., server, may commonly be referred to as a denial-of-service attack. In a denial-of-service attack, the network device is flooded with so many additional requests that regular traffic is either slowed or completely interrupted. Typically, the denial-of-service attack uses multiple computers throughout the network. A denial-of-service attack that uses multiple computers may commonly be referred to as a distributed denial-of-service attack.

[0004] Such attacks may involve the dissemination through the network, such as the Internet, of a malicious program, e.g., virus, worm program. The malicious program typically contains both the code for sourcing a variety of attacks, e.g., distributed denial-of-service attack, and some basic communication infrastructure to allow for remote control. For example, a user commonly referred to as an attacker may disseminate a malicious program by transmitting the malicious program over the Internet with random Internet Protocol (IP) destination addresses. If one of the random destination addresses is an address of a “vulnerable” computer system, e.g., server, then the malicious program may be installed on that computer system. A computer system may be said to be “vulnerable” if the computer system cannot detect and hence prevent the malicious program from being installed. Hence, an attacker may be able to install malicious programs on other computer systems thereby producing a group of “zombie” computers to carry out the attack.

[0005] Computer systems may store security management tools configured to detect known patterns of known malicious programs. For example, security management tools may examine each received IP packet and determine if it matches a known pattern. If so, then the dissemination of a malicious program may be detected. However, if the security management tools do not detect a known pattern, then the security management tools may determine that a malicious program is not being disseminated on the computer system. Hence, a newly created malicious program whose pattern is unknown may not be detected by the security management tools.

[0006] As stated above, the dissemination of malicious programs by an attacker typically involves the attacker transmitting the malicious program over the network, e.g., Internet, with random IP destination addresses. By detecting the randomness in IP destination addresses, the dissemination of newly created malicious programs may be detected.

[0007] It would therefore be desirable to detect the randomness in Internet Protocol (EP) destination addresses in order to detect the dissemination of malicious programs.

SUMMARY

[0008] The problems outlined above may at least in part be solved in some embodiments by detecting the randomness in the Internet Protocol (IP) destination addresses of received IP packets. In one embodiment, the randomness in the IP destination addresses may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

[0009] In one embodiment of the present invention, a method for detecting the dissemination of a malicious program, e.g., virus, worm program, may comprise the step of a gateway receiving an IP packet of data to be forwarded to an external network, e.g., Internet, from a client. The gateway may be configured to function as an entry/exit point to the external network whereby the gateway performs protocol conversion between different types of networks. The IP packet received by the gateway may contain a malicious program with a random destination address.

[0010] The gateway may perform a hash function on the destination address, e.g., 32-bits long, of the received IP packet to generate a hash value, e.g., 8-bit value. It is noted that the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address and transfer will involve an unacknowledged datagram. Hence, the gateway may perform a hash function on other fields of the received IP packet such as source address, source port, destination port, packet length, protocol, type of service and identification, conjunctively to or independently from performing the hash function on the destination address. It is further noted that even though the following discusses performing a hash function on the destination address to generate a hash value that the present invention is not to be limited to only performing a hash function on the destination address to generate a hash value. Alternatively, a hash function may be performed on other fields of the received IP packet such as source address, source port, destination port, packet length, protocol, type of service and identification, conjunctively to or independently from performing the hash function on the destination address. It would be appreciated by those of ordinary skill that the present inventive principles apply to hashes performed on such fields. It is further noted these embodiments would fall within the scope of the present invention.

[0011] The generated hash value may then be indexed into a table or associative array where each entry may correspond to a particular hash value. The corresponding entry in the table or associative array may be marked as occupied, e.g., a “1” bit value may be stored, if the entry is not already marked as occupied. An unoccupied entry may store the complement of the value stored in entries marked as occupied. A counter, which may be implemented in either software or hardware in the gateway, may be incremented by one to indicate the number of packets examined.

[0012] A determination may then be made as to whether the predetermined number of packets, e.g., one thousand packets to be forwarded to the external network, has been examined. In one embodiment, whether the predetermined number of packets has been examined may be determined by the value of the counter as described above. If less than the predetermined number of packets has been examined, then the gateway may receive another IP packet to be forwarded to an external network as described above.

[0013] If the predetermined number of packets, e.g., one thousand packets to be forwarded to the external network, has been examined by the gateway, then the gateway may determine the number of different hash values generated from performing the hash function on the IP destination addresses of the predetermined number of packets. In one embodiment, the number of different hash values generated from performing the hash function on the IP destination addresses of the predetermined number of packets may be determined by counting the number of entries in the table marked as being occupied.

[0014] A determination may then be made as to whether the number of different hash values generated is less than the following:

F*2{circumflex over ( )}B

[0015] where F is a predetermined fraction, e.g., ¼, and B is a number of bits of the hash value, e.g., 8-bits.

[0016] For example, if F has a value of ¼ and the hash values generated by the hash function were 8-bits long, then F*2{circumflex over ( )}B equals 64 (¼*256). Hence, a determination may be made if less than 64 different hash values were generated by performing the hash function on the IP destination addresses of the predetermined number of packets, e.g., one thousand packets to be forwarded to the external network. If less than 64 hash values were generated, then an inference may be made that the gateway may be receiving non-random destination addresses. If 64 or greater different hash values were generated, then an inference may be made that the gateway may be receiving random destination addresses.

[0017] As stated above, if the number of different hash values generated were less than F*2{circumflex over ( )}B, then an inference may be made that the gateway may be receiving non-random destination addresses as stated above. Since the gateway may be receiving non-random destination addresses, the gateway may examine a higher number of packets up to a maximum number during the next examination cycle captured in the steps described above as illustrated in the following equation:

<i>N</i>(<i>i+</i>1)=<i>K*N</i>(<i>i</i>)+(1−<i>K</i>)*<i>MAX </i>

[0018] where i is an index of the number of packets to be examined; where N(i+1) is the next number of packets to be examined during the next examination cycle; where N(i) is the predetermined number of packets in the examination cycle just completed; where K is a constant between the values of 0 and 1; and where MAX is a maximum number of packets to be examined.

[0019] For example, if the gateway examined one thousand packets in the examination cycle just completed (N(i)=1,000) and K=½ and MAX=2,000, then the next number of packets to be examined during the next examination cycle (N(i+1)) equals 1,500.

[0020] Upon determining the next number of packets to be examined during the next examination cycle, the gateway may start the next examination cycle by receiving an IP packet to be forwarded to an external network as described above.

[0021] If, however, the number of different hash values generated were greater than or equal to F*2{circumflex over ( )}B, then an inference may be made that the gateway may be receiving random destination addresses. If the number of different hash values generated were greater than or equal to F*2{circumflex over ( )}B, then a determination may be made as to whether the number of packets examined in the examination cycle just completed (N(i)) is less than or equal to a predetermined threshold. If the number of packets examined in the examination cycle just completed (N(i)) is less than or equal to the predetermined threshold, then the dissemination of a malicious program may be indicated. This may occur when a high percentage of entries in the table are marked as occupied versus the total number of entries in the table based on a small number of packets examined. That is, by generating a high number of different hash values for a small number of received packets, it may provide strong evidence of the gateway receiving random IP destination addresses within a short period of time. Receiving random IP destination addresses within a short period of time may be indicative of the dissemination of a malicious program.

[0022] Upon detecting the dissemination of a malicious program, one of a series of actions may occur. For example, the IP packets examined in subsequent examination cycles with similar characteristics, e.g., same source address, same length, same protocol, etc., may be discarded by the gateway. By discarding packets with similar characteristics to the IP packets just examined, the dissemination of a malicious program may be prevented. Furthermore, the gateway may transmit an alert to a responsible administrator indicating that the dissemination of a malicious program has been detected. Another activity, may be that the IP packets examined in the examination cycle just completed may be forwarded to the destinations specified by the destination addresses. Furthermore, in conjunction with forwarding the IP packets examined, the gateway may transmit an alert to a responsible administrator indicating that the dissemination of a malicious program has been detected. By transmitting the alert, in conjunction with forwarding the IP packets examined, IP packets examined in subsequent examination cycles with similar characteristics, e.g., same source address, same length, same protocol, etc., to the forwarded IP packets may be discarded by the gateway. By discarding packets with similar characteristics, e.g., same source address, same length, same protocol, etc., to the forwarded IP packets, the dissemination of a malicious program may be prevented. In conjunction with either of the above activities or independently from the above activities, the gateway may maintain an event record of detecting the dissemination of the malicious program.

[0023] However, if the number of packets examined in the examination cycle just completed (N(i)) exceeds the predetermined threshold, then the gateway may examine a lower number of packets during the next examination cycle as illustrated in the following equation:

<i>N</i>(<i>i+</i>1)=<i>K*N</i>(<i>i</i>)

[0024] where i is an index of the number of packets to be examined; where N(i+1) is the next number of packets to be examined during the next examination cycle; where K is a constant between the values of 0 and 1; and where N(i) is the predetermined number of packets in the examination cycle just completed.

[0025] The gateway may examine a lower number of packets during the next examination cycle in order to ensure that the gateway is receiving random destination addresses from the dissemination of a malicious program and not detecting randomness from normal traffic. For example, if the gateway examined one thousand packets in the examination cycle just completed (N(i)=1,000) and K=½, then the next number of packets to be examined (N(i+1)) equals 500.

[0026] Upon determining the next number of packets to be examined during the next examination cycle, the gateway may start the next examination cycle by receiving an IP packet to be forwarded to an external network as described above.

[0027] It is noted that the above steps may be performed by other devices such as a router, switch or edge device. It is further noted that even though the above describes detecting the dissemination of a malicious program by detecting the randomness in IP destination addresses that additional factors may be used conjunctively to or independently from the factor of detecting random IP destination addresses. For example, the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address, transfer will involve an unacknowledged datagram. These additional characteristics may be used conjunctively to or independently from the factor of detecting random IP destination addresses.

[0028] The foregoing has outlined rather broadly the features and technical advantages of one or more embodiments of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

[0029] A better understanding of the present invention can be obtained when the following detailed description is considered in conjunction with the following drawings, in which:

[0030]FIG. 1 illustrates a network system configured in accordance with the present invention;

[0031]FIG. 2 illustrates an embodiment of a client in the network system configured in accordance with the present invention;

[0032]FIG. 3 illustrates an embodiment of a network device in the network system that may be subject to a denial-of-service attack in accordance with the present invention;

[0033]FIG. 4 illustrates an embodiment of a gateway in accordance with the present invention; and

[0034]FIG. 5 is a flowchart of a method for detecting a dissemination of a malicious program in accordance with the present invention.

DETAILED DESCRIPTION

[0035] It is noted that even though the description of the present invention describes detecting the dissemination of a malicious program by detecting the randomness in IP destination addresses that additional factors may be used conjunctively or independently from the factor of detecting random IP destination addresses. For example, the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address and transfer will involve an unacknowledged datagram. These additional characteristics may be used conjunctively or independently from the factor of detecting random IP destination addresses. It is further noted that embodiments applying these additional characteristics either conjunctively to or independently from the factor of detecting random IP destination addresses would fall within the scope of the present invention.

[0036]FIG. 1—Network System

[0037]FIG. 1 illustrates an embodiment of a network system <b>100</b> in accordance with the present invention. Network system <b>100</b> may comprise one or more clients <b>101</b>A-C coupled to an external network <b>103</b>, e.g., Internet, via a gateway <b>102</b>. Gateway <b>102</b> may be configured to function as an entry/exit point to external network <b>103</b> whereby gateway <b>102</b> performs protocol conversion between different types of networks. Clients <b>101</b>A-C may collectively or individually be referred to as clients <b>101</b> or client <b>101</b>, respectively. A more detailed description of client <b>101</b> is provided below in conjunction with FIG. 2. A more detailed description of gateway <b>102</b> is provided further below in conjunction with FIG. 4. In one embodiment, clients <b>101</b>A-C may be coupled to a router (not shown) located at the edge of a subnet (not shown), e.g., Local Area Network (LAN), where the subnet may comprise clients <b>101</b>A-C coupled to the router (not shown). It is noted that network system <b>100</b> may be divided into multiple subnets where each subnet (not shown), e.g., Local Area Network (LAN), Campus LAN, may be an interconnected, but independent, segment or domain of network system <b>100</b>.

[0038] As stated above, gateway <b>102</b> may be coupled to an external network <b>103</b>. External network <b>103</b> may be a LAN, e.g., Ethernet, Token Ring, ARCnet, or a Wide Area Network (WAN), e.g., Internet. External network <b>103</b> may be coupled to a network device <b>104</b>, e.g., web server, server in a server farm, that may be subject to the installment of a malicious program. A more detailed description of network device <b>104</b> is provided further below in conjunction with FIG. 3. It is noted that the connection between clients <b>101</b> and gateway <b>102</b> may be any medium type, e.g., wireless, wired. It is further noted that client <b>101</b> may be any type of device, e.g., wireless, Personal Digital Assistant (PDA), portable computer system, cell phone, personal computer system, workstation, Internet appliance, configured with the capability of connecting to network <b>103</b> and consequently communicating with network device <b>104</b>. It is further noted that network system <b>100</b> may be any type of system that has at least one client <b>101</b>, at least one device such as gateway <b>102</b>, an external network <b>103</b> and a network device <b>104</b> subject to the installment of a malicious program. It is further noted that network system <b>100</b> is not to be limited in scope to any one particular embodiment. For example, gateway <b>102</b> may be a router located at the edge of a subnet. In another example, gateway <b>102</b> may be a switch configured to direct the flow of data from one network to another network. In another example, gateway <b>102</b> may be an edge device, e.g., net enforcer, configured to monitor traffic at the edge of a subnet.

[0039] Referring to FIG. 1, each client <b>101</b>A-C may comprise a web browser <b>105</b>A-C, respectively, which may be configured for communicating with network <b>103</b>, e.g., Internet, and for reading and executing web pages. Browsers <b>105</b>A-C may collectively or individually be referred to as browsers <b>105</b> or browser <b>105</b>, respectively. While the illustrated client engine is a web browser <b>105</b>, those skilled in the art will recognize that other client engines may be used in accordance with the present invention.

[0040] Network device <b>104</b>, e.g., web server, may comprise a web page engine <b>106</b> for maintaining and providing access to an Internet web page which is enabled to forward static web pages to web browser <b>105</b> of client <b>101</b>. Web pages are typically formatted as a markup language file, for example, HyperText Markup Language (HTML) or Extended Markup Language (XML).

[0041]FIG. 2—Hardware Configuration of Client

[0042]FIG. 2 illustrates a typical hardware configuration of client <b>101</b> which is representative of a hardware environment for practicing the present invention. Client <b>101</b> may have a central processing unit (CPU) <b>210</b> coupled to various other components by system bus <b>212</b>. An operating system <b>240</b> may run on CPU <b>210</b> and provide control and coordinate the functions of the various components of FIG. 2. An application <b>250</b> in accordance with the principles of the present invention may run in conjunction with operating system <b>240</b> and provide calls to operating system <b>240</b> where the calls implement the various functions or services to be performed by application <b>250</b>. Application <b>250</b> may include, for example, web browser <b>105</b>. Read-Only Memory (ROM) <b>216</b> may be coupled to system bus <b>212</b> and include a basic input/output system (“BIOS”) that controls certain basic functions of client <b>101</b>. Random access memory (RAM) <b>214</b> and Input/Output (I/O) adapter <b>218</b> may also be coupled to system bus <b>212</b>. It should be noted that software components including operating system <b>240</b> and application <b>250</b> may be loaded into RAM <b>214</b> which may be the computer system's main memory for execution. I/O adapter <b>218</b> may be a small computer system interface (“SCSI”) adapter that communicates with a disk unit <b>220</b>, e.g., disk drive. It is noted that web browser <b>105</b> may reside in disk unit <b>220</b> or in application <b>250</b>.

[0043] Referring to FIG. 2, client <b>101</b> may further comprise a communications adapter <b>234</b> coupled to bus <b>212</b>. Communications adapter <b>234</b> may enable client <b>101</b> to communicate with gateway <b>102</b> (FIG. 1) and network device <b>104</b> (FIG. 1). I/O devices may also be connected to system bus <b>212</b> via a user interface adapter <b>222</b> and a display adapter <b>236</b>. Keyboard <b>224</b>, mouse <b>226</b> and speaker <b>230</b> may all be interconnected to bus <b>212</b> through user interface adapter <b>222</b>. Event data may be inputted to client <b>101</b> through any of these devices. A display monitor <b>238</b> may be connected to system bus <b>212</b> by display adapter <b>236</b>. In this manner, a user is capable of inputting, e.g., issuing requests to read web pages, transmitting a malicious program across network <b>103</b> with random Internet Protocol (IP) destination addresses, to client <b>101</b> through keyboard <b>224</b> or mouse <b>226</b> and receiving output from client <b>101</b> via display <b>238</b>.

[0044]FIG. 3—Hardware Configuration of Network Device

[0045]FIG. 3 illustrates an embodiment of the present invention of network device <b>104</b>. Referring to FIG. 3, network device <b>104</b> may comprise a processor <b>310</b> coupled to various other components by system bus <b>312</b>. Read-Only Memory (ROM) <b>316</b> may be coupled to system bus <b>312</b> and include a basic input/output system (“BIOS”) that controls certain basic functions of network device <b>104</b>. Random access memory (RAM) <b>314</b>, disk adapter <b>318</b> and communications adapter <b>334</b> may also be coupled to system bus <b>312</b>. RAM <b>312</b> may be network device's <b>105</b> main memory for execution. Disk adapter <b>318</b> may be a small computer system interface (“SCSI”) adapter that communicates with disk units <b>320</b>, e.g., disk drive. Communications adapter <b>334</b> may interconnect bus <b>312</b> with network <b>104</b> enabling network device <b>104</b> to communicate with gateway <b>102</b> (FIG. 1) and client <b>101</b> (FIG. 1).

[0046]FIG. 4—Hardware Configuration of Gateway

[0047]FIG. 4 illustrates an embodiment of the present invention of gateway <b>102</b>. Referring to FIG. 4, gateway <b>102</b> may comprise a processor <b>410</b> coupled to various other components by system bus <b>412</b>. An operating system <b>440</b>, may run on processor <b>410</b> and provide control and coordinate the functions of the various components of FIG. 4. An application <b>450</b> in accordance with the principles of the present invention may run in conjunction with operating system <b>440</b> and provide calls to operating system <b>440</b> where the calls implement the various functions or services to be performed by application <b>450</b>. Application <b>450</b> may include, for example, a program for detecting the dissemination of a malicious program as described in FIG. 5. Read-Only Memory (ROM) <b>416</b> may be coupled to system bus <b>412</b> and include a basic input/output system (“BIOS”) that controls certain basic functions of gateway <b>102</b>. Random access memory (RAM) <b>414</b>, disk adapter <b>418</b> and communications adapter <b>434</b> may also be coupled to system bus <b>412</b>. It should be noted that software components including operating system <b>440</b> and application <b>450</b> may be loaded into RAM <b>414</b> which may be the gateway's <b>102</b> main memory for execution. Disk adapter <b>418</b> may be a small computer system interface (“SCSI”) adapter that communicates with a disk unit <b>420</b>, e.g., disk drive. It is noted that the program of the present invention that detects the dissemination of a malicious program, as described in FIG. 5, may reside in disk unit <b>420</b> or in application <b>450</b>. Communications adapter <b>434</b> may interconnect bus <b>412</b> with network <b>104</b> enabling gateway <b>102</b> to communicate with network device <b>104</b> (FIG. 1) and client <b>101</b> (FIG. 1). Gateway <b>102</b> may further comprise a non-volatile memory <b>460</b> coupled to bus <b>412</b>. Non-volatile memory <b>460</b> may be configured to store a hash table as described in greater detail in conjunction with FIG. 5. It is noted that the hash table may be stored in ROM <b>416</b>, e.g., flash ROM, disk unit <b>420</b>. It is further noted that the hash table may be stored in other storage units not illustrated and that such storage units would be known to a person of ordinary skill in the art. It is further noted that such storage units would fall within the scope of the present invention. It is further noted that the description of gateway <b>102</b> in FIG. 4 may also be the description of a router located at the edge of a subnet, a switch or an edge device. It is further noted that these other devices, e.g., router, switch, edge device, may also store the program of the present invention that detects the dissemination of a malicious program, as described in FIG. 5, in their disk unit <b>420</b> or application <b>450</b>.

[0048] Implementations of the invention include implementations as a computer system programmed to execute the method or methods described herein, and as a computer program product. According to the computer system implementations, sets of instructions for executing the method or methods are resident in RAM <b>414</b> of one or more computer systems configured generally as described above. Until required by gateway <b>102</b>, the set of instructions may be stored as a computer program product in another computer memory, for example, in disk drive <b>420</b> (which may include a removable memory such as an optical disk or floppy disk for eventual use in disk drive <b>420</b>). Furthermore, the computer program product can also be stored at another computer and transmitted when desired to the user's workstation by a network or by an external network such as the Internet. One skilled in the art would appreciate that the physical storage of the sets of instructions physically changes the medium upon which it is stored so that the medium carries computer readable information. The change may be electrical, magnetic, chemical or some other physical change.

[0049]FIG. 5—Method for Detecting a Dissemination of a Malicious Program

[0050]FIG. 5 is a flowchart of one embodiment of the present invention of a method <b>500</b> for detecting the dissemination of a malicious program, e.g., virus, worm program. As stated in the Background Information section, computer systems may store security management tools configured to detect known patterns of known malicious programs. For example, security management tools may examine each received Internet Protocol (IP) packet and determine if it matches a known pattern. If so, then the dissemination of a malicious program may be detected. However, if the security management tools do not detect a known pattern, then the security management tools may determine that a malicious program is not being disseminated on the computer system. Hence, a newly created malicious program whose pattern is unknown may not be detected by the security management tools. Since the dissemination of malicious programs by an attacker typically involves transmitting the malicious program over the network, e.g., Internet, with random IP destination addresses, the dissemination of malicious programs may be detected by detecting the randomness in IP destination addresses. It would therefore be desirable to detect the randomness in IP destination addresses in order to detect the dissemination of malicious programs. Method <b>500</b> is a method for detecting the randomness in IP destination addresses in order to detect the dissemination of malicious programs.

[0051] Referring to FIG. 5, in conjunction with FIGS. 1 and 4, in step <b>501</b>, gateway <b>102</b> may receive an IP packet of data to be forwarded to another network <b>103</b>, e.g., Internet, from client <b>101</b>. As stated in the Background Information section, an attacker may disseminate a malicious program, e.g., virus, worm program, by transmitting the malicious program over the network with random IP destination addresses. For example, a user of client <b>101</b>, e.g., client <b>101</b>A, may disseminate a malicious program onto several vulnerable computer systems, e.g., network device <b>104</b>, by transmitting IP packets storing the malicious program in its payload over network <b>103</b>. These IP packets may contain random IP destination addresses in their headers where the IP destination address may be an address of a vulnerable computer system, e.g., network device <b>104</b>. Hence, the IP packet received by gateway <b>102</b> may contain a malicious program in its payload with a random IP destination address in its header.

[0052] In step <b>502</b>, gateway <b>102</b> may perform a hash function on the destination address, e.g., 32-bits long, of the received IP packet to generate a hash value, e.g., 8-bit value. In one embodiment, gateway <b>102</b> may extract and concatenate the IP destination address and IP source port (if it exists) from the packet header of the received IP packet. The concatenation of the two fields may then be inputted to the hash function to generate a hash value. It is noted that the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address and transfer will involve an unacknowledged datagram. Hence, gateway <b>102</b> may perform a hash function on other fields of the received IP packet such as source address, source port, destination port, packet length, protocol, type of service and identification, conjunctively to or independently from performing the hash function on the destination address. It is further noted that even though the following discusses performing a hash function on the destination address to generate a hash value that the present invention is not to be limited to only performing a hash function on the destination address to generate a hash value. Alternatively, a hash function may be performed on other fields of the received IP packet such as source address, source port, destination port, packet length, protocol, type of service and identification, conjunctively to or independently from performing the hash function on the destination address. It would be appreciated by those of ordinary skill that the present inventive principles apply to hashes performed on such fields. It is further noted these embodiments would fall within the scope of the present invention.

[0053] In step <b>503</b>, the hash value may be indexed into a table or associative array where each entry may correspond to a particular hash value. In step <b>504</b>, the corresponding entry in the table or associative array may be marked as occupied, e.g., a “1” bit value may be stored, if the entry is not already marked as occupied. An unoccupied entry may store the complement of the value stored in entries marked as occupied. In step <b>505</b>, a counter, which may be implemented in either software or hardware in gateway <b>102</b>, may be incremented by one to indicate the number of packets examined.

[0054] In step <b>506</b>, a determination may be made as to whether the predetermined number of packets, e.g., one thousand packets to be forwarded to external network <b>103</b>, has been examined. In one embodiment, whether the predetermined number of packets has been examined may be determined by the value of the counter as described above. If less than the predetermined number of packets has been examined, then gateway <b>102</b> may receive another IP packet of data to be forwarded to external network <b>103</b> in step <b>501</b>.

[0055] If the predetermined number of packets, e.g., one thousand packets to be forwarded to external network <b>103</b>, has been examined by gateway <b>102</b>, then gateway <b>102</b>, in step <b>507</b>, may determine the number of different hash values generated from performing the hash function on the IP destination addresses of the predetermined number of packets. In one embodiment, the number of different hash values generated from performing the hash function on the IP destination addresses of the predetermined number of packets may be determined by counting the number of entries in the table marked as being occupied.

[0056] In step <b>508</b>, a determination may be made as to whether the number of different hash values generated is less than the following:

F*2{circumflex over ( )}B

[0057] where F is a predetermined fraction, e.g., ¼, and B is a number of bits of the hash value, e.g., 8-bits.

[0058] For example, if F has a value of ¼ and the hash values generated by the hash function in step <b>502</b> were 8-bits long, then F*2{circumflex over ( )}B equals 64 (¼*256). Hence, a determination may be made if less than 64 different hash values were generated by performing the hash function on the IP destination addresses of the predetermined number of packets, e.g., one thousand packets to be forwarded to external network <b>103</b>. If less than 64 hash values were generated, then an inference may be made that gateway <b>102</b> may be receiving non-random destination addresses. If 64 or greater different hash values were generated, then an inference may be made that gateway <b>102</b> may be receiving random destination addresses.

[0059] For example, if the length of the hash values generated in step <b>502</b> were 8-bits long, then there are a total possible 2{circumflex over ( )}8 (256) different hash values that may be generated. Each hash value may be able to index into a particular entry in a table. Hence, the table may comprise 256 entries where each entry may correspond to a particular hash value. If 200 different hash values were generated by performing the hash function on the IP destination addresses of the predetermined number of packets, e.g., one thousand packets to be forwarded to external network <b>103</b>, then 200 out of the 256 entries in the table are marked as being occupied. Since the percentage of entries marked versus the total number of entries in the table is high, it may be indicative of receiving random IP destination addresses. That is, since a large number of different hash values were generated, it may be indicative of receiving random IP destination addresses. If the percentage of entries marked versus the total number of entries in the table were low, then it may be indicative of receiving non-random IP destination addresses. That is, since a small number of different hash values were generated, it may be indicative of receiving non-random IP destination addresses. The determination of whether gateway <b>102</b> may be receiving random or non-random IP destination addresses may be captured in the formula F*2{circumflex over ( )}B as discussed above.

[0060] Referring to step <b>508</b>, if the number of different hash values generated were less than F*2{circumflex over ( )}B, then an inference may be made that gateway <b>102</b> may be receiving non-random destination addresses as stated above. Since gateway <b>102</b> may be receiving non-random destination addresses, gateway <b>102</b> may examine a higher number of packets up to a maximum number during the next examination cycle captured in steps <b>501</b>-<b>506</b> as illustrated in the following equation:

<i>N</i>(<i>i+</i>1)=<i>K*N</i>(<i>i</i>)+(1−<i>K</i>)*<i>MAX </i>  (EQ1)

[0061] where i is an index of the number of packets to be examined; where N(i+1) is the next number of packets to be examined during the next examination cycle; where N(i) is the predetermined number of packets in the examination cycle just completed; where K is a constant between the values of 0 and 1; and where MAX is a maximum number of packets to be examined.

[0062] For example, if gateway <b>102</b> examined one thousand packets in the examination cycle just completed (N(i)=1,000) and K=½ and MAX=2,000, then the next number of packets to be examined during the next examination cycle (N(i+1)) equals 1,500. Hence, gateway <b>102</b> will examine one thousand five hundred packets during the next examination cycle as discussed above in steps <b>501</b>-<b>506</b>.

[0063] Upon determining the next number of packets to be examined during the next examination cycle, gateway <b>102</b> may start the next examination cycle by receiving an IP packet to be forwarded to external network <b>103</b> in step <b>501</b>.

[0064] Referring to step <b>508</b>, if the number of different hash values generated were greater than or equal to F*2{circumflex over ( )}B, then an inference may be made that gateway <b>102</b> may be receiving random destination addresses. If the number of different hash values generated were greater than or equal to F*2{circumflex over ( )}B, then a determination may be made in step <b>510</b> as to whether the number of packets examined in the examination cycle just completed (N(i)) is less than or equal to a predetermined threshold. If the number of packets examined in the examination cycle just completed (N(i)) is less than or equal to the predetermined threshold, then the dissemination of a malicious program may be detected in step <b>511</b>. This may occur when a high percentage of entries in the table are marked as occupied versus the total number of entries in the table based on a small number of packets examined. That is, by generating a high number of different hash values for a small number of received packets, it may provide strong evidence of gateway <b>102</b> receiving random IP destination addresses within a short period of time. Receiving random IP destination addresses within a short period of time may be indicative of the dissemination of a malicious program.

[0065] Upon detecting the dissemination of a malicious program, one of a series of actions may occur. For example, in step <b>512</b>, the IP packets examined in subsequent examination cycles with similar characteristics, e.g., same source address, same length, same protocol, etc., to the packets just examined may be discarded by gateway <b>102</b>. By discarding packets with similar characteristics, e.g., same destination address, same length, same protocol, etc., to the IP packets just examined, the dissemination of a malicious program may be prevented. Furthermore, gateway <b>102</b> may transmit an alert to a responsible administrator indicating that the dissemination of a malicious program has been detected. Another activity, captioned in step <b>513</b>, may be that the IP packets examined in the examination cycle just completed may be forwarded to the destinations specified by the destination addresses. Furthermore, in conjunction with forwarding the IP packets examined, gateway <b>102</b> may transmit an alert to a responsible administrator indicating that the dissemination of a malicious program has been detected. By transmitting the alert, in conjunction with forwarding the IP packets examined, IP packets examined in subsequent examination cycles with similar characteristics, e.g., same source address, same length, same protocol, etc., to the forwarded IP packets may be discarded by gateway <b>102</b>. By discarding packets with similar characteristics, e.g., same source address, same length, same protocol, etc., to the forwarded IP packets, the dissemination of a malicious program may be prevented. In conjunction with steps <b>512</b> and/or <b>513</b>, or independently from steps <b>512</b> and <b>513</b>, gateway <b>102</b> may maintain an event record of detecting the dissemination of the malicious program in step <b>514</b>. In one embodiment, the event record may contain the day/date/time of the occurrence of detecting the dissemination of the malicious program. The event record may further contain the source user address as well as the captured data.

[0066] Referring to step <b>510</b>, if the number of packets examined in the examination cycle just completed (N(i)) exceeds a predetermined threshold, then gateway <b>102</b> may examine a lower number of packets during the next examination cycle in step <b>515</b> as illustrated in the following equation:

<i>N</i>(<i>i+</i>1)=<i>K*N</i>(<i>i</i>)   (EQ2)

[0067] where i is an index of the number of packets to be examined; where N(i+1) is the next number of packets to be examined during the next examination cycle; where K is a constant between the values of 0 and 1; and where N(i) is the predetermined number of packets in the examination cycle just completed.

[0068] Gateway <b>102</b> may examine a lower number of packets during the next examination cycle in order to ensure that gateway <b>102</b> is receiving random destination addresses from the dissemination of a malicious program and not detecting randomness from normal traffic. For example, if gateway <b>102</b> examined one thousand packets in the examination cycle just completed (N(i)=1,000) and K=½, then the next number of packets to be examined (N(i+1)) equals 500. Hence, gateway <b>102</b> will examine five hundred packets during the next examination cycle as discussed above in steps <b>501</b>-<b>506</b>.

[0069] Upon determining the next number of packets to be examined during the next examination cycle, gateway <b>102</b> may start the next examination cycle by receiving an IP packet to be forwarded to an external network <b>103</b> in step <b>501</b>.

[0070] It is noted that method <b>500</b> may be executed in a different order presented and that the order presented in the discussion of FIG. 5 is illustrative. It is further noted that certain steps in FIG. 5 may be executed almost concurrently. It is further noted that the steps of method <b>500</b> may be performed by other devices such as a router, switch or edge device. It is further noted that even though the above describes detecting the dissemination of a malicious program by detecting the randomness in IP destination addresses that additional factors may be used conjunctively to or independently from the factor of detecting random IP destination addresses. For example, the dissemination of a malicious program typically has the following additional characteristics: a constant or nearly constant IP packet size, a constant or random IP source address, transfer will involve an unacknowledged datagram. These additional characteristics may be used conjunctively to or independently from the factor of detecting random IP destination addresses.

[0071] Although the system, computer program product and method are described in connection with several embodiments, it is not intended to be limited to the specific forms set forth herein; but on the contrary, it is intended to cover such alternatives, modifications and equivalents, as can be reasonably included within the spirit and scope of the invention as defined by the appended claims. It is noted that the headings are used only for organizational purposes and not meant to limit the scope of the description or claims.