Method and apparatus for predictive and actual intrusion detection on a network

A monitored networked computing system comprising:

• a network;
• a plurality of computing devices coupled to the network and configured to exchange information packets with each other;
• a network analyzer coupled to the network, wherein the network analyzer includes mechanisms for capturing information packets;
• and
• a linguistic analyzer coupled to the network analyzer and operable to identify preselected linguistic patterns in the captured information packets, wherein the linguistic patters are preselected to identify network packets that preemptively indicate a future network attack.

A computer implemented device for monitoring network traffic comprising:

• computer code configured to be executed on a processor to cause the processor to capture information packets from a network;
• computer code configured to be executed on a processor to cause the processor to identify linguistic patterns in the captured network packets;
• computer code configured to be executed on a processor to cause the processor to score captured network packets based on similarity of at least one identified linguistic pattern to one or more of the defined set of linguistic patterns;
• and
• computer code configured to be executed on a processor to cause the processor to implement at least one responsive action when a packet that is scored above a specified threshold value is identified.

A computing device configured to monitor network traffic, the computing device comprising:

• a processor;
• memory coupled to the processor;
• a port coupled to an external network;
• computer code executable using the processor and memory and operable to identify network traffic on the external network that is associated with prospective malicious activity.

A method of detecting a prospective network attack by monitoring network traffic, the method comprising:

• defining a set of linguistic patterns, where each linguistic pattern is associated with a condition that has been determined to be indicative of a prospective network attack;
• monitoring the network traffic over time;
• identifying the linguistic patterns when they occur in network traffic;
• accumulating information about the identified occurrences of the linguistic patterns over time;
• and
• using the accumulated information as a basis for determining likelihood of a prospective network attack.