Patent ID: 7458094

Claim:
A method for detecting unauthorized intrusion in a computer network, comprising the steps of: copying packets that are being transmitted in real-time over the computer network; sorting the copied packets based on port type; sending packets of a particular port type to one or more port modules, each port module being designed for processing packets of a single port type; processing packets with each port module by reviewing and comparing information from various parts of each packet; determining a presence and absence of port-specific activities based on each packet with each port module; generating binary vectors representing the presence and absence of port-specific activities based on each packet with each port module; assessing each binary vector and determining a level of expertise and deception for the port-specific activities represented by the binary vector with each port module; outputting a behavioral rating from each port module in real-time based on the assessing and determining steps, the behavioral rating comprising at least two dimensions of deception and expertise.