Patent ID: 7712134
Filing Date: 2010-05-04
Classification: H04L

Abstract:
1. A method for detecting a virus of a network, comprising the steps of: determining a plurality of metrics to represent relative uncertainties of a plurality of traffic features; determining, using a computer system and for a time window of a plurality of time windows, a plurality of divergences each representing a difference, within the time window, between a pair of metrics among the plurality of metrics; determining, using the computer system, a global metric to represent a maximum one of the plurality of divergences for the time window; monitoring, using the computer system and over the plurality of time windows, traffic in the network using the global metric; identifying one or more network traffic anomaly in real time when the global metric exceeds a pre-determined threshold; analyzing the one or more network traffic anomaly to generate an analysis in real time; and determining the network virus based on the analysis in real time, wherein the global metric is determined by calculating Max-PMER as a ratio R where K represents the plurality of metrics, x and y represent a pair of metrics exhibiting highest divergence in the plurality of metrics within the i