Intrusion Detection Within a Distributed Processing System

摘要

A computer implemented method monitors activity within a device driver layer of a computer. An arrival rate is identified within a device driver for the node. The arrival rate is a rate at which packets arrive at a network adapter of the node from all other nodes within a network. If the arrival rate exceeds at least one threshold, the node undergoes a state change. The at least one threshold delineates between a plurality of states for the node.