METHOD AND SYSTEM FOR CONFIDENT ANOMALY DETECTION IN COMPUTER NETWORK TRAFFIC

摘要

The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack.

主权项

1. A method for detecting and classifying network traffic anomalies, comprising:
receiving a packet of information related to network traffic; passing said packet to one or a plurality of network traffic analyzers; at least some of said network traffic analyzers capable of applying an analytical algorithm to information contained in said packet that is different from the analytical algorithm applied by another of said network traffic analyzers; receiving results of analysis performed by said analyzers; evaluating results of analysis performed by said analyzers as a collection; determining if the result of evaluation signifies a network traffic anomaly; and emitting an alert if the result of evaluation signifies a network traffic anomaly.