METHOD OF NETWORK TRAFFIC SIGNATURE DETECTION

摘要

A method for identifying anomalous network traffic is provided. The method involves observing network traffic (steps 10, 11) for a deviation from the normal or expected traffic characteristics (step 12). When the presence of a significant deviation is detected, a structured portion of a sample of the network traffic is analysed (step 13) to identify a commonality or pattern present in the contents of the network traffic, which occur with a frequency that would approximately provide the deviation from the normal or expected traffic characteristics. An identified signature may be translated into human or machine readable form (step 14).