Patent ID: 8146160

Claim:
A method for generating and using security policies for a computer network, the method comprising: detecting authentication events involving host computers contacting authentication servers on the computer network by monitoring activity involving the authentication servers; extracting authentication information for each of the authentication events including user names, host computer addresses, destination addresses, and authentication protocols from the authentication events and updating a usage model database containing legitimate network communications with the extracted authentication information including the user names, host computer addresses, destination addresses, and authentication protocol; using the authentication information of the usage model database to define security policies, the usage model characterizing legitimate network communications by reference to at least user names, host computer addresses, and destination addresses; detecting new authentication events on the computer network; extracting authentication information from the authentication events; and comparing the authentication information against the security policies for the network, the security policies defining legitimate network communications with respect to at least the user names, the host computer addresses, the destination addresses and the authentication protocols, and generating alerts if the new authentication events violate the security policies and indicating modification of the usage model if the new authentication events are not encompassed by the security policies, that is neither consistent with the security policies nor a breach of the security policies.