Device and method for detection of anomalous behavior in a computer network
US9401932B2 · kind B2 · utility
9Cited by
5References
24Claims
0Family size
Assignee
Inventors
Key dates
| Filing date | Jan 3, 2014 |
| Grant date | Jul 26, 2016 |
| Priority date | — |
| Expiry date | Apr 13, 2034 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/14
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A device and method for providing forensic data in network activity indicative of the presence of malware. A distributed set of network-based sensors operates within an enterprise network in cooperation with a centralized analytics and correlation engine that correlates detected events across the sensors to detect malicious activity on a monitored network which may include using a multi-tiered or Rete net rule set or engine. When malicious activity is detected upon the satisfaction of a predetermined set of conditions, the invention traces the activity to a host responsible for the activity for further action.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.