Patent ID: 8144603

Claim:
An apparatus for detecting an anomalous event in a network, the apparatus comprising: a packet receiver configured to receive a packet; a packet analyzer configured to analyze the packet and obtain source and destination Internet protocol (IP) addresses of the packet; an IP state-vector manager configured to allocate prescribed token numbers to a system and an ambient environment discriminated by the IP addresses, define an IP state vector having the token numbers as elements, determine a state vector value by updating the token numbers of the IP state vector according to the source and destination IP addresses of the packet, and obtain a state number of the state vector value by counting the state vector value; a port-number state-vector manager configured to allocate prescribed token numbers to services discriminated by port numbers, define a port-number state vector having the token numbers as elements, determine a state vector value by updating the token numbers of the port-number state vector according to the source and destination token numbers of the packet, and obtain a state number of the state vector value by counting the state vector value; an entropy calculator configured to calculate entropies related to the IP address and the port number, based on the number and the state number of the state vector values related to the IP state vector and the port-number state vector; and an anomalous event determiner configured to determine whether there is an anomalous event in the network based on the calculated entropies.