USING ADDRESS RANGES TO DETECT MALICIOUS ACTIVITY

摘要

A method for detecting malicious programs within a network, includes monitoring at least one packet within the network to ascertain a source address and a destination address of the at least one packet, determining whether the source address and the destination address of the at least one packet match addresses within a listing of addresses of devices on the network and generating an alert when neither the source address nor the destination address of the at least one packet match addresses within the listing of addresses of devices on the network.