DESCRIPTION OF DRAWINGS
FIG. 1 is a block diagram of a network including anomaly detection.
FIG. 2A is a block diagram depicting exemplary details of a worm detection system.
FIG. 2B is a block diagram depicting exemplary details of a worm signature distribution system.
FIG. 3 is a block diagram depicting an aggregator.
FIG. 4 is a flow chart of a mitigation process.
FIG. 5 is a flowchart of a worm detection and signature generation process.
FIG. 6 is a flow chart of a worm signature distribution process.
FIG. 7 is a block diagram of traffic attributes.
FIG. 8 is a flow chart of a worm detection process.
FIG. 9 is a flow chart of a signature detection process.
FIG. 10 is a flow chart of an anomaly detection process.
FIG. 11 is a flow chart of a tree generation process.
FIG. 12 is a flow chart of a connectedness determination process.
FIG. 13 is a flow chart of a signature consolidation process.
FIG. 14 is a block diagram of email traffic attributes.
FIG. 15 is a flow chart of an email-based worm detection process.
FIG. 16 is a flow chart of a signature detection process.
FIG. 17 is a flow chart of an anomaly detection process.
FIG. 18 is a flow chart of a signature consolidation process.