Patent ID: 7958559
Filing Date: 2011-06-07
Classification: G06F

Abstract:
1. A method for determining a malicious workload pattern, the method comprising: collecting a training set of workload patterns during a predetermined workload situation, wherein the workload patterns are dependent on a characteristic of the usage of a plurality of elements in a system, the elements being data communication ports, the system being a part of a network; determining by a computer processor a subset of the training set as an archetype set, the archetype set being considered to be representative of the predetermined workload situation, wherein determining the archetype set comprises: calculating a threshold value dependent on the training set and the archetype set, wherein calculating the threshold value comprises: calculating an evaluation value dependent on a given workload pattern and the archetype set, wherein calculating the evaluation value comprises: determining the given workload pattern to be malicious if the evaluation value fulfils a given condition with respect to the threshold value, wherein the given workload pattern is determined to be malicious if the evaluation value is larger than the threshold value; wherein a plurality of given workload patterns are determined to be malicious or not, and wherein the steps of collecting the training set, determining the archetype set and calculating the threshold value are performed once for the plurality of given workload patterns and the steps of calculating the evaluation value and determining the given workload pattern to be malicious are performed for each given workload pattern of the plurality of the given workload patterns.