Patent ID: 8572736

Claim:
A system for detecting anomalous behavior in information access, comprising: a network interface unit for receiving data packets containing an information access request; a memory for storing a database containing historical behavior information, the historical behavior information being implemented through a plurality of bitmap tables and counters, content of each counter being derived from the bitmap tables, each counter having a threshold; and a controller for analyzing the information access request, parsing the information access request into a plurality of basic elements, the plurality of basic elements comprises who, how, what, where, and when, and storing the information access request in the memory, wherein the controller compares each parsed basic element of the information access request with one or more tables, each table relating two basic elements, records a result of comparison into one or more counters, issues an alert if a counter exceeds the threshold associated with this counter, checks whether there is a baseline associated with a parsed content of the information access request, and establishes a baseline using the parsed content of the information access request if there is no baseline associated with the parsed content of the information access request, the plurality of basic elements directly map to information embedded in the information access request received by the network interface, and if a counter has no threshold, the controller sets a new threshold for the counter using information from a parsed basic element associated to the counter.