Patent ID: 9479521
Filing Date: 2016-10-25
CPC Classification: H04L

Claim Text:
1. A method comprising: detecting, at a detection module, an indicator corresponding to a suspicious software component, wherein the indicator is detected based on monitored network data of a network system and based on a plurality of network behavior profiles, wherein the plurality of network behavior profiles correspond to a plurality of suspicious software components, and wherein a first network behavior profile of the plurality of network behavior profiles includes a first ordered sequence of network actions associated with a first suspicious software component of the plurality of suspicious software components; combining a first rating associated with the indicator and a second rating associated with a second indicator to generate a total rating for a particular internet protocol address associated with a device that corresponds to the monitored network data; after determining to provide the indicator to an identification module based on a comparison of the total rating with a threshold value, determining, at the identification module, whether the indicator corresponds to any of the plurality of network behavior profiles; and generating output data in response to a determination that the indicator corresponds to a particular network behavior profile of the plurality of network behavior profiles.