Patent ID: 9350707
Filing Date: 2016-05-24
CPC Classification: G06N,H04L

Claim Text:
1. A computer-implemented method for detecting a computing device that is compromised by an undetected attack, the method comprising: a) obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include transmission from the compromised computing device; b) creating, by the one or more processors, a combined packet from at least a subset of the plurality of TCP packets and IP packets obtained in a), wherein the combined packet comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets; c) obtaining a meta-expression that: d) determining whether the meta-expression obtained in c) appears in the combined packet created in b); e) if the meta-expression obtained in c) appears in the combined packet created in b), then initiating an operation.