Abstract: A method is disclosed in which a system compares a first set of reports characterizing network traffic flows originating from an endpoint device with a second set of reports characterizing network traffic flows originating from the endpoint device and stored at an external network device to determine whether the first set and second set of reports characterizing network traffic flows originating from an endpoint device are different. In response to determining that the first and second reports characterizing network traffic flows are different, the system identifies the network traffic flows originating from the endpoint device and reported by an external network device, but not reported by the endpoint device, as possibly indicative of malware and forwards the network traffic flows originating from the endpoint device to an analyzer for further processing.

Abstract: A method is disclosed in which a system compares a first set of reports characterizing network traffic flows originating from an endpoint device with a second set of reports characterizing network traffic flows originating from the endpoint device and stored at an external network device to determine whether the first set and second set of reports characterizing network traffic flows originating from an endpoint device are different. In response to determining that the first and second reports characterizing network traffic flows are different, the system identifies the network traffic flows originating from the endpoint device and reported by an external network device, but not reported by the endpoint device, as possibly indicative of malware and forwards the network traffic flows originating from the endpoint device to an analyzer for further processing.

Abstract: A congested link identification system is configured to be used in connection with a network for facilitating transfer of message packets among a plurality of information utilization devices. The network comprises a plurality of switching nodes interconnected by a plurality of communication links, at least some of the information utilization devices being configured to transfer message packets thereamong over paths through the network, with each path comprising at least one communication link. The congested link identification system comprises a plurality of congestion detection agents and a congestion link identification processor. Each congestion detection agent is associated with one of the information utilization devices. Each congestion detection agent is configured to generate congested path information indicating whether respective paths used by the information utilization device associated with the respective congestion detection information are congested.