Abstract: A method and apparatus for detecting compromised host computers (e.g., Bots) are disclosed. For example, the method identifies a plurality of suspicious hosts. Once identified, the method analyzes network traffic of the plurality suspicious hosts to identify a plurality suspicious hub-servers. The method then classifies the plurality of candidate Bots into at least one group. The method then identifies members of each of the at least one group that are connected to a same controller from the plurality suspicious controllers, where the members are identified to be part of a Botnet.

Abstract: A method and apparatus for providing network traffic composite graphs for packet networks are disclosed. The graph enables analysts to visually determine the relative size of an event in relation to other traffic activity. For example, a user or a network analyst creates categories of applications for the river-chart graph and optionally enters a weight factor for each of the application categories. The method then gathers records for flows, number of bytes (or packets), etc. from monitoring device(s) in a predetermined interval. The expected values are determined and composite volumes are calculated for each protocol and/or port. The method then updates the cumulative river-chart bands and the cumulative expected values for historical and predicted time periods in the river-chart graph.

Abstract: A method and apparatus for generating a reconnaissance index for a communications network is described. In one embodiment, scan detection data is initially received. A number of scan flows and a number of unique source Internet protocol (SIP) addresses initiating said number of scan flows is then identified from said scan detection data. Afterwards, a reconnaissance index is generated by utilizing said number of scan flows and said number of unique SIP addresses.

Abstract: A method and apparatus for detecting compromised host computers (e.g., Bots) are disclosed. For example, the method identifies a plurality of suspicious hosts. Once identified, the method analyzes network traffic of the plurality suspicious hosts to identify a plurality suspicious hub-servers. The method then classifies the plurality of candidate Bots into at least one group. The method then identifies members of each of the at least one group that are connected to a same controller from the plurality suspicious controllers, where the members are identified to be part of a Botnet.