DISTRIBUTED NETWORK PROTECTION

摘要

Network traffic is analyzed in a hierarchical framework to learn and identify normal behavior of the network, and to identify deviations from the normal behavior. A system for protecting a network comprises sniffer modules (122) and a processing module (116). The sniffer modules (122) are implemented in nodes (108) of the network to sniff traffic on segments of the network that are coupled to the nodes. The processing module collects and analyzes the traffic in a hierarchical framework to learn and identify normal behaviour of the network, and to identify deviations from the normal behavior.