Patent ID: 8621615

Claim:
A method comprising: determining, by a device, a plurality of traffic behavior patterns, the plurality of traffic behavior patterns being associated with a respective plurality of user roles associated with a user; monitoring, by the device, a traffic flow on a network, the monitoring of the traffic flow including: determining a user role, of the plurality of user roles, associated with the traffic flow, identifying, based on the determined user role, a traffic behavior pattern of the plurality of traffic behavior patterns, and identifying a traffic behavior associated with the traffic flow; comparing, by the device, the traffic behavior, associated with the traffic flow, and the traffic behavior pattern to form comparison results; determining, by the device and based on the comparison results, whether an anomaly is associated with the traffic flow, determining whether the anomaly is associated with the traffic flow including: determining that the anomaly is associated with the traffic flow when the traffic flow is associated with a first network protocol that differs from a second network protocol associated with the traffic behavior pattern; performing, by the device and when the anomaly is associated with the traffic flow, a security response; and updating, when the anomaly is not associated with the traffic flow, the traffic behavior pattern based on monitoring the traffic flow, the traffic behavior pattern not being updated based on monitoring the traffic flow when the anomaly is associated with the traffic flow.