Mi sono imbattuto in questo interessante brevetto intitolato " Rilevamento delle infezioni basato sulla rete utilizzando il rallentamento dell'host "
Cito dall'abstract di questo brevetto:
Host malware (or change) may be detected by (1) receiving baseline set of response time information for each of one or more transactions involving (A) the host and (B) at least one peer of the host, (2) determining or receiving a later set of response time information for each of the one or more transactions involving the host and the at least one peer of the host, and (3) determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information. The execution of a host malware (or change) protection policy may be controlled using at least the determination of whether or not host slowdown has occurred.