Patent ID: 7743420

Claim:
A method for fast protection of enterprise applications of a secured system, wherein the method comprises: entering a learn mode of the secured system; collecting, by a computer, enterprise application events by analyzing network level protocol attributes gathered and reconstructed by network sensors of the secured system and by polling information about recent enterprise application events from servers of the secured system; analyzing the enterprise application events; generating an adaptive normal behavior profile (NBP) by learning the normal behavior of users and the enterprises applications over time, wherein the adaptive NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a plurality of profile properties; performing statistical analysis to determine if the adaptive NBP is stable, wherein the statistical analysis comprises: computing a percentage of learning progress for each profile item and profile property out of the total number of the enterprise application events received over a predefined time; and determining the respective profile item or the profile property as stable if the percentage of learning progress exceeds a predefined threshold; and exiting the learn mode and entering a protect mode for the secured system.