Patent ID: 9215244
Filing Date: 2015-12-15
Classification: G06F,H04B,H04L,H04W

Abstract:
1. A method for context aware network security monitoring for threat detection, the method comprising: monitoring, by at least one processor, behavior of each of at least one node, associated with at least one user, in a network to generate a behavior profile for each of the at least one user, wherein the behavior of each of the at least one node is based on traffic flow through each of the at least one node, wherein the traffic flow is monitored by analyzing an Internet Protocol (IP) packet header of at least one data packet that has traveled through each of the at least one node, and wherein the IP packet header contains a security signature portion, the security signature portion includes geolocation information for at least one of the nodes that the data packet has passed or routed; comparing, by the at least one processor, the behavior profile for the at least one user with a baseline behavior profile for the at least one user; determining, by the at least one processor, when there is a difference between the behavior profile for the at least one user and the baseline behavior profile for the at least one user; flagging an event associated with the difference, by the at least one processor, when the difference at least one of exceeds a baseline threshold level, does not exceed a baseline threshold level, meets at least one criterion, and does not meet at least one criterion; and classifying the event, by the at least one processor, to an event classification.