Patent ID: 8654655

Claim:
A method of identifying anomalous network traffic, the traffic containing a plurality of data units that each have at least one feature with an associated value, the method comprising: (i) performing a detector function on the network traffic to determine whether the network traffic contains an anomaly; (ii) if an anomaly is detected, storing a predetermined amount of the network traffic including the anomalous network traffic, and dividing the stored predetermined amount of network traffic into a plurality of sets, the traffic being divided in dependence on the value of one or more of the at least one feature; (iii) performing the detector function on each one of the plurality of sets for determining, for each set, whether the anomaly is present, said determining, for each set, further comprises associating a score with that set, which score is indicative of the extent to which that set is considered anomalous, that set being considered to be anomalous by comparing the score with a first threshold and the score is above the first threshold, and to be normal by comparing the score with a second threshold different from the first threshold and the score is below the second threshold; (iv) if an anomaly is present in a set, dividing that set into a further plurality of sets, wherein steps (iii) and (iv) are each performed a plurality of times in an iterative manner; wherein terminating the method when step (iv) has been performed in respect of each at least one feature or when the anomaly is detected to be present in each of the sets resulting from step (iii); and classifying the anomaly in each of the sets according to the type of network event that caused the anomaly.