Network surveillance

A method of network surveillance, comprising:

• monitoring network packets handled by a network entity;
• building a long-term and multiple short-term statistical profiles of the network packets;
• comparing one of the multiple short-term statistical profiles with the long-term statistical profile;
• and
• determining whether the difference between the one of the multiple short-term statistical profiles and the long-term statistical profile indicates suspicious network activity.

A computer program product, disposed on a computer readable medium, the product including instructions for causing a processor to:

• receive network packets handled by a network entity;
• build at least one long-term and at least one short-term statistical profile from at least one measure of the network packets, the measure monitoring data transfers, errors, or network connections;
• compare at least one short-term and at least one long-term statistical profile;
• and
• determine whether the difference between the short-term statistical profile and the long-term statistical profile indicates suspicious network activity.

A method of network surveillance, comprising:

• receiving packets at a virtual private network entity;
• and
• building at least one long-term and at least one short-term statistical profile based on the received packets, and
• comparing at least one long-term statistical profile with at least one short-term statistical profile to determine whether the packets indicate suspicious network activity.