Patent ID: 8869276

Claim:
A method for detecting anomalies in network traffic, the method comprising: during at least one training interval, collecting network traffic data comprising data from N network sources at a plurality of time periods t, where N>1; assigning, by a processor, the network traffic data collected during the at least one training interval from the N network sources to dimensions of an r-dimensional subspace, wherein 0<r≦N and each of the dimensions r corresponds to a degree of variance of the data along an orthogonal dimension of the r-dimensional subspace; computationally analyzing the r-dimensional subspace to identify dimensions corresponding to a normal subspace S 1 thereof, the dimensions of the normal subspace S 1 containing only data corresponding to normal network traffic of the network traffic data collected during the at least one training interval; computationally defining an anomalous subspace S 2 by removing dimensions corresponding to the normal subspace S 1 from dimensions corresponding to the r-dimensional subspace, the anomalous subspace S 2 representing behavior of anomalous network traffic in the network traffic data; during an operational time interval, receiving network data traffic and computationally projecting the network traffic data received during the operational time interval onto the anomalous subspace S 2 to create a projection representing a degree of anomalous variation in the received network data traffic; and based on the projection, classifying the network traffic data received during the operational time interval as anomalous if the degree of anomalous variation exceeds a threshold.