Generation technique in a computerized environment

A computerized host configured for detecting a current attack in a computerized environment, the computerized host comprising:

• at least one processor;
• and
• at least one non-volatile memory comprising instructions that, upon execution by the at least one processor, cause the computerized device to perform operations comprising:
• generating a signature which is specific for a type of activity in the computerized environment based on historic data of the activity, wherein the signature specifies averaged normalized numbers of occurrences of the activity per time frame of a plurality of recurring time frames;
• determining a threshold value for the activity based on the historic data of the activity and a statistical measure;
• monitoring current data of the activity in the computerized environment;
• and
• generating an attack detection alert based on determining that the current data of the activity exceeds the threshold value for a current time frame, wherein:
• (a) each recurring time frame is a fixed, predefined interval that repeats cyclically;
• and
• (b) the averaged normalized number for the recurring time frame is produced by:
• (i) counting occurrences of the activity in each sub-frame of that recurring time frame over a plurality of previous cycles of the recurring time frame;
• (ii) summing the counts from the plurality of cycles for each sub-frame to obtain a total count for the recurring time frame;
• and
• (iii) dividing, for each sub-frame, the summed count of that sub-frame by the total count for the recurring time frame.

A non-transitory computer-readable storage medium comprising instructions that, upon execution by a processor of a computing device, cause the computing device to perform operations comprising:

• generating a signature which is specific for a type of activity in the computerized environment based on historic data of the activity, wherein the signature specifies averaged normalized numbers of occurrences of the activity per time frame of a plurality of recurring time frames;
• determining a threshold value for the activity based on the historic data of the activity and a statistical measure;
• monitoring current data of the activity in the computerized environment;
• and
• generating an attack detection alert based on determining that the current data of the activity exceeds the threshold value for a current time frame;
• wherein:
• (a) each recurring time frame is a fixed, predefined interval that repeats cyclically;
• and
• (b) the averaged normalized number for the recurring time frame is produced by:
• (i) counting occurrences of the activity in each sub-frame of that recurring time frame over a plurality of previous cycles of the recurring time frame;
• (ii) summing the counts from the plurality of cycles for each sub-frame to obtain a total count for the recurring time frame;
• and
• (iii) dividing, for each sub-frame, the summed count of that sub-frame by the total count for the recurring time frame.