Patent ID: 8572736
Filing Date: 2013-10-29
Classification: G06F,H04L

Abstract:
1. A system for detecting anomalous behavior in information access, comprising: a network interface unit for receiving data packets containing an information access request; a memory for storing a database containing historical behavior information, the historical behavior information being implemented through a plurality of bitmap tables and counters, content of each counter being derived from the bitmap tables, each counter having a threshold; and a controller for analyzing the information access request, parsing the information access request into a plurality of basic elements, the plurality of basic elements comprises who, how, what, where, and when, and storing the information access request in the memory, wherein the controller the plurality of basic elements directly map to information embedded in the information access request received by the network interface, and if a counter has no threshold, the controller sets a new threshold for the counter using information from a parsed basic element associated to the counter.