Dynamic learning method and adaptive normal behavior profile (NBP) architecture for providing fast protection of enterprise applications

A computer program product, comprising non-transitory computer readable media with instructions to enable a computer to implement a method fast protection of enterprise applications of a secured system, wherein the method comprises:

• entering a learn mode of the secured system;
• collecting enterprise application events by analyzing network level protocol attributes gathered and reconstructed by network sensors of the secured system and by polling information about recent enterprise application events from servers of the secured system;
• analyzing the enterprise application events;
• generating an adaptive normal behavior profile (NBP) by learning the normal behavior of users and the enterprises applications over time, wherein the adaptive NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a plurality of profile properties;
• performing statistical analysis to determine if the adaptive NBP is stable, wherein the statistical analysis comprises:
• computing a percentage of learning progress for each profile item and profile property out of the total number of the enterprise application events received over a predefined time;
• and determining the respective profile item or the profile property as stable if the percentage of learning progress exceeds a predefined threshold;
• and
• exiting the learn mode and entering a protect mode for the secured system.

A non-intrusive network security system, including a memory, that utilizes a dynamic process for learning the behavior of enterprise applications for the purpose of allowing the fast protection of the enterprise applications, wherein the security system comprises:

• a plurality of network sensors capable of collecting, reconstructing, and processing enterprise application events by analyzing network level protocol attributes and by polling information about recent enterprise application events from servers of the secured system, during a learn mode of the security system and storing in the memory;
• a secure server coupled to the plurality of network sensors, the secure server capable of building adaptive normal behavior profiles (NBPs) during the learn mode of the security system by learning the normal behavior of users and the enterprises applications over time, wherein the secure server further perform statistical analysis to determine if the adaptive NBP is stable, wherein the statistical analysis comprises:
• computing a percentage of learning progress for each profile item and profile property out of the total number of the enterprise application events received over a predefined time;
• and determining the respective profile item or the profile property as stable if the percentage of learning progress exceeds a predefined threshold;
• and
• connectivity means enabling the plurality of network sensors to monitor traffic directed to at least devices that require protection.