Patent ID: 9331916
Filing Date: 2016-05-03
CPC Classification: H04L

Claim Text:
1. In a Security Information and Event Management (SIEM) system, a method of monitoring a device at a particular address on a network, the method comprising: recording, by processing circuitry, data indicative of traffic flow to and from the particular address on the network over a period of time; performing, by the processing circuitry, a categorization operation on the data to generate a categorization result indicative of whether the data satisfies one of a group of constraint sets, each constraint set of the group of constraint sets corresponding to a category of a set of categories, each category of the set of categories having a label associated with that category; and applying, by the processing circuitry, a label of a particular category to the device at the particular address when the categorization result indicates that the data satisfies the constraint set of the group of constraint sets that corresponds to the particular category, the application of a label of a category indicating that the device behaves as a member of that category, wherein the set of categories includes a server category and a client category, wherein performing the categorization operation includes: wherein applying the label of the particular category to the device at the particular address includes: