Device and method for detection of anomalous behaviour in computer network activity

摘要

A sequence of data representing network behaviour is analysed using the technique of delay space embedding. This causes a sequence of tuples to be constructed from the data sequence. This sequence of tuples can then be represented in a multi-dimensional representation space, which allows detection of network behaviour divergent from a norm by a human operator. In particular, the data representing network behavious may be the inter-packet arrival time.