Platform-based method and apparatus for containing worms using multi-timescale heuristics

摘要

A processing unit analyzes network traffic using a multi-timescale heuristic having multiple traffic windows. Each traffic window has a respective threshold value and a respective timescale. When a threshold value is exceeded, the processing unit triggers a network circuit breaker, causing a host platform to be isolated from the network.