Patent ID: 8490197
Filing Date: 2013-07-16
Classification: G06Q,H04L

Abstract:
1. A system that detects the state of a computer network having a plurality of nodes, comprising: a plurality of distributed agents disposed in said computer network, each said distributed agent configured to perform the steps of: passively collecting, monitoring, and aggregating data representative of activities of said plurality of nodes; performing a pattern analysis on the collected data to identify patterns in the collected data representative of suspicious activities and to develop activity models from the collected data representative of activities of said computer network in a normal state and activities of said computer network in an abnormal state based on said identified patterns; comparing the results of the pattern analysis of data collected by each said agent to the results of pattern analysis of data collected by another agent to identify similar patterns of suspicious activity in different portions of the computer network; and based on said comparing, at least one agent determining whether said computer network is in said normal state or said abnormal state at different times and dynamically updating said activity models based on said collected data.