Monitoring traffic to specific destinations in a network

摘要

The present invention monitors from a first location in a computer network traffic emanating from a source at a second location in the network, the apparatus comprising means at the first location for detecting traffic emanating from the source and means for monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic. The invention monitors the behaviour of a source of network traffic in terms of characteristic of traffic emanating from the source and facilitates the detection of throttle failure. The failure of a throttle will enable a virus to spread more freely. This monitoring process can trigger various responses such as the isolation of the source from the network.