Patent ID: 11888882
Assignee: BANK OF AMERICA CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A system comprising:
a plurality of hosts on an enterprise network, each host of the plurality of hosts sending communications via the enterprise network; and
a computing device, comprising:
a processor; and
non-transitory memory storing instructions that, when executed by the processor, cause the computing device to:
monitor, by a network traffic correlation engine, network communications aggregated from the plurality of hosts on the enterprise network, wherein the network communications comprises inbound and outbound connection information received from each host on the enterprise network;
identify, by the network traffic correlation engine, whether a correlation exists between a first communication sent from a first host device via the enterprise network to a second host device and a second communication received via the enterprise network by the second host device;
determine, based on whether a correlation exists between the first communication and the second communication, whether an anomalous communication condition exists; and
trigger, based on the correlation, an alert identifying that the anomalous communication condition is present between the first host device and the second host device.