Patent ID: 9680693
Date: 2017-06-13
CPC Classifications: H04L

Claim:
1. A network traffic anomaly detector comprising: a network interface connecting to a network to be monitored to extract multiple network traffic statistics, each as a time series, the network statistics being extracted by performing a count over a time window of a given type of network activity at a given location; a first analyzer receiving the network traffic statistics to characterize a variability with respect to time of the network traffic statistics; a second analyzer receiving the network traffic statistics to characterize a correspondence with respect to time between different network traffic statistics, the correspondence reflecting a statistical dependence between the different network statistics; and a detection unit receiving the variability and correspondence characterizations from the first and second analyzer to provide an output indicating a likelihood of a network anomaly wherein the network traffic statistics include at least two different measures of rates of data flow on the network, wherein the network interface extracts network traffic statistics in pairs of symmetrical counts that structurally tend to be proportionally related.