Patent ID: 9628497
Date: 2017-04-18
CPC Classifications: G06F,G06N,H04L

Claim:
1. An intrusion detection method for detecting an intrusion in data traffic on a data communication network, the method comprising: parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic; associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields; assessing if a contents of the extracted protocol field is in a safe region as defined by the model; and generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region, wherein in a learning phase a model is built for the extracted protocol field, the learning phase comprising: providing a plurality of model types, determining a data type of the extracted protocol field, selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and building the model for the extracted protocol field on the basis of the selected model type.