System, method and program for identifying and preventing malicious intrusions

Abstract

Computer system, method and program product for identifying a malicious intrusion. A first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, are identified from a source IP address during a predetermined period. A determination is made that in one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures. Based on the determination that in the one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures, a determination is made that the messages are characteristic of a malicious intrusion.

1 . A method for identifying a malicious intrusion, said method comprising the steps of: 
 determining a first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, from a source IP address during a predetermined period; and    determining that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures.    
   
   
       2 . A method as set forth in  claim 1  further comprising the steps of: 
 based on the step of determining that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, determining that said messages are characteristic of a malicious intrusion.    
   
   
       3 . A method as set forth in  claim 2  further comprising the steps of: 
 determining that in another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures; and    based on the steps of determining that in said one or more other such predetermined periods and said another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, determining that said messages are characteristic of a malicious intrusion.    
   
   
       4 . A system for identifying a malicious intrusion, said system comprising: 
 means for determining a first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, from a source IP address during a predetermined period; and    means for determining that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures.    
   
   
       5 . A system as set forth in  claim 4  further comprising: 
 means, responsive to the means for determining that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, for determining that said messages are characteristic of a malicious intrusion.    
   
   
       6 . A method as set forth in  claim 5  further comprising: 
 means for determining that in another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures; and    means, responsive to the means for determining that in said one or more other such predetermined periods and said another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, for determining that said messages are characteristic of a malicious intrusion.    
   
   
       7 . A computer program product for identifying a malicious intrusion, said computer program product comprising: 
 a computer readable medium;    first program instructions to determine a first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, from a source IP address during a predetermined period; and    second program instructions to determine that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures; and wherein    said first and second program instructions are stored on said medium.    
   
   
       8 . A computer program product as set forth in  claim 7  further comprising: 
 third program instructions, responsive to the second program instructions determining that in one or more other such predetermined periods said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, to determine that said messages are characteristic of a malicious intrusion; and wherein    said third program instructions are stored on said medium.    
   
   
       9 . A computer program product as set forth in  claim 8  further comprising: 
 fourth program instructions to determine that in another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures; and    fifth program instructions, responsive to the third and fourth program instructions determining that in said one or more other such predetermined periods and said another such predetermined period said source IP address sent messages having said first number of different destination IP addresses, said second number of different destination ports and said third number of different signatures, to determine that said messages are characteristic of a malicious intrusion; and wherein    said fourth and fifth program instructions are stored on said medium.