Method and apparatus for examining network traffic and automatically detecting anomalous activity to secure a computer

A system for automatically detecting anomalous activity in memory to secure a computer, comprising:

• one or more processors communicatively coupled to a network;
• wherein the one or more processors are configured to:
• examine at least one data segment of network traffic that is directed to at least one endpoint computer;
• extract features from the at least one data segment of network traffic;
• define file groupings based on the extracted features;
• classify the at least one data segment of network traffic into the file groupings using the extracted features;
• and
• assign confidence values to the file groupings;
• generate profile information, wherein the profile information is generated from the file groupings;
• access profile information associated with the at least one endpoint computer, wherein the profile information indicates characteristics of non-anomalous network traffic;
• compute confidence indicia for the at least one data segment of network traffic, wherein the confidence indicia are computed based on the accessed profile information and at least a portion of the at least one data segment of network traffic;
• apply the heuristic information to the confidence indicia to identify anomalous network activity;
• and
• communicate indicia of detection as to the anomalous network activity to the at least one endpoint computer.

A non-transitory computer-readable-storage medium comprising one or more processor-executable instructions that, when executed by at least one processor, cause the at least one processor to:

• examine at least one data segment of network traffic that is directed to at least one endpoint computer;
• extract features from the at least one data segment of network traffic;
• define file groupings based on the extracted features;
• classify the at least one data segment of network traffic into the file groupings using the extracted features;
• and
• assign confidence values to the file groupings;
• generate profile information, wherein the profile information is generated from the file groupings;
• access profile information associated with the at least one endpoint computer, wherein the profile information indicates characteristics of non-anomalous network traffic;
• compute confidence indicia for the at least one data segment of network traffic, wherein the confidence indicia are computed based on the accessed profile information and at least a portion of the at least one data segment of network traffic;
• compare the confidence indicia with heuristic information to identify anomalous network activity for the at least one endpoint computer;
• and
• communicate indicia of detection as to the anomalous network activity to the at least one endpoint computer.