Back to results
US 6,708,212 B2Granted
Network surveillance
AssigneeSRI International
InventorsPhillip Andrew Porras, Alfonso Valdes
Life of this patent
Estimating the term…
Abstract
A method of network surveillance includes receiving network packets handled by a network entity and building at least one long-term and a least one short-term statistical profile from a measure of the network packets that monitors data transfers, errors, or network connections. A comparison of the statistical profiles is used to determine whether the difference between the statistical profiles indicates suspicious network activity.
Claims24
Method for monitoring an enterprise network, said method comprising the steps of:
- deploying a plurality of network monitors in the enterprise network;
- detecting, by the network monitors, suspicious network activity based on analysis of network traffic data, wherein at least one of the network monitors utilizes a statistical detection method;
- generating, by the monitors, reports of said suspicious activity;
- and
- automatically receiving and integrating the reports of suspicious activity, by one or more hierarchical monitors.
2 more elements
An enterprise network monitoring system comprising:
- a plurality of network monitors deployed within an enterprise network, said plurality of network monitors detecting suspicious network activity based on analysis of network traffic data, wherein at least one of the network monitors utilizes a statistical detection method;
- said network monitors generating reports of said suspicious activity;
- and
- one or more hierarchical monitors in the enterprise network, the hierarchical monitors adapted to automatically receive and integrate the reports of suspicious activity.
1 more element
Dependencies are inferred from the claim text.