Patent ID: 7792049

Claim:
A method implemented in a non-transitory machine-readable medium and to execute on a proxy, the method comprising: monitoring, by the proxy, a service for interactions with given network protocol; deriving, by the proxy, one or more behavior vectors for the service with respect to the given protocol; comparing, by the proxy, additional activity of the service for the given protocol against the one or more behavior vectors; and determining, by the proxy, whether the additional activity falls within a desired threshold for the service, the one or more behavior vectors represents a sub set of behaviors or actions that exist for a given network protocol ontology assigned to the given network protocol, the given network protocol ontology defines behavior semantics of a given communication language that is the given network protocol, the behavior semantics define a sub set of permissible commands, parameters, and interactions of parties using the given communication language, the one or more behavior vectors are automatically derived from the given network protocol ontology after observing actions of the parties with respect to the given network protocol over a period of time, the given network protocol ontology defines a semantic space or universe for the given network protocol in a formal manner, each behavior vector is mapped to a point in the semantic space and the additional activity is also mapped to another point in the semantic space, any two points in the semantic space are subtracted to obtain a semantic distance that is compared to the desired threshold to determine when the additional activity is permissible, impermissible, and suspect.