Patent ID: 8910285
Filing Date: 2014-12-09
Classification: H04L

Abstract:
1. A method of detecting suspected malicious network activity, the method comprising: accessing, by one or more computing processors, a watch-list of network endpoints and a catalog of traffic models characterizing malicious network activity; monitoring, by the one or more computing processors, network traffic comprising one or more data packets; collecting, by the one or more computing processors, a set of data packets from the network traffic; comparing, by the one or more computing processors, endpoint data from the collected set of data packets to one or more network endpoints in the watch-list of network endpoints; comparing, by the one or more computer processors, packet data from the collected set of data packets to one or more traffic models in the catalog of traffic models for malicious network activity; determining, by the one or more computing processors, based on one of the comparing endpoint data with the watch-list and the comparing packet data with the catalog of traffic models, that the set of data packets comprise suspected malicious network activity; and adding, by the one or more computing processors, responsive to the determining, one of: