Patent ID: 7359930

Claim:
A method of determining a similarity between a first host and a second host based on the network behavior of the first and second hosts comprising acts of: a) determining a first score based on the similarity between network traffic of top services using the first host and network traffic of top services using the second host; b) determining a second score based on a total network traffic of the first host and a total network traffic of the second host; c) combining the first and second scores to generate a similarity value, wherein the act b) further comprises an act of determining the second score based on a directionality and a magnitude of the total traffic of the first and second hosts, and wherein the method further comprises: b1) representing the first host as a first point on a Cartesian plane based on the directionality and magnitude of the total traffic of the first host; b2) representing the second host as a second point on a Cartesian plane based on the directionality and magnitude of the total traffic of the second host; b3) computing a Euclidean distance between the first and second points; and b4) combining the Euclidean distance and the first score to generate the similarity value.