Patent ID: 9621578
Date: 2017-04-11
CPC Classifications: H04L

Claim:
1. A computer-implemented method for detecting a network activity of interest, the method comprising: (a) obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include the network activity of interest; (b) creating, by the one or more processors, a combined packet from at least two network packets of the plurality of network packets obtained in (a), (c) obtaining a stored meta-expression that: (d) determining whether the meta-expression obtained in (c) appears in the combined packet created in (b); (e) in response to determining that the meta-expression obtained in (c) appears in the combined packet created in (b), initiating an operation.