Identifying significant behaviors within network traffic

摘要

A system and a method for identifying significant behaviors from network traffic. A probability value is assigned to each cluster in a set of clusters. An uncertainty value is computed indicating a level of variability among the probability values. One or more clusters are removed from the set of clusters until the uncertainty value exceeds a desired uncertainty threshold, and each of the removed clusters is identified as a significant cluster.