Patent ID: 9401932
Filing Date: 2016-07-26
CPC Classification: F01D,H04L

Claim Text:
1. A method for identifying an anomalous behavior in a network of host computing elements comprising the steps of: providing 1-n network sensors in a computer network and in data communication therewith, wherein each network sensor is configured to sense or identify a characteristic of a network data packet, a network flow, or both being communicated across the computer network, outputting, by at least one of the network sensors, a sensor notification upon the satisfaction of a predetermined set of network data conditions, outputting the 1-n sensor notifications to a 1-n Rete net-based rule engine configured to execute a one or more Rete algorithms configured for the deterministic detection of an anomalous behavior in the network based on the notifications, executing the one or more Rete algorithms, and outputting an alarm signal upon the detection of the anomalous behavior.