Patent ID: 7143442

Claim:
A method of analyzing network events on the basis of data in respect of processed network traffic events, each data data item identifying attributes thereof, the attributes including at least a time at which a respective network traffic event was processed and a network address identifying a network device from and/or to which packets were sent, (i) evaluating a correlation between attributes of the received data so as to identify groups of attributes that meet a correlation criterion; (ii) for those groups that meet the correlation criterion, replacing the attributes in the group with a factor representative thereof; (iii) identifying clusters of factors from at least some of the processed network traffic event data; (iv) identifying time intervals, and assigning each of the data items to a time interval in accordance with that data item's associated time value; (v) for each time interval, for each value of network address attribute in the data, categorizing the data items corresponding thereto into one of the clusters; (vi) for each value of network address attribute in the data, identifying pairs of time intervals so as to generate a plurality of pairs of clusters; (vii) for each possible cluster pairing, counting the number of occurrences thereof, and identifying any cluster pairings for which the number of occurrences is less than a predetermined number.