Patent ID: 8352589

Claim:
A method of adaptively monitoring a computer network, the method comprising: providing a computer network that includes a plurality of associated network components and a plurality of terminals connected thereto, the pluralities of network components and terminals configured to run a plurality of application programs at least one of which is configured to perform one or more user initiated activities, two or more of the network components and/or terminals being associated with one or more identifying attributes, each identifying attribute being a value that can be determined at a given time for any network component or terminal; providing one or more activity signatures each usable to detect that a specific activity has been performed; detecting, using the one or more activity signatures, one or more baselined attributes of one or more user initiated activities of the two or more of the network components and/or terminals, each baselined attribute being defined by its own signature that may extend beyond an associated activity signature; measuring, after the detecting, one or more of the same baselined attribute values of the two or more network components and/or terminals; and grouping network components and/or terminals into a plurality of subsets thereof based on the measured attribute values so as to yield group descriptions, each group description describing a group of the network components and/or terminals whose members share related characteristics in the measured baselined attribute values, the yielded group descriptions being monitoring profiles that are usable to detect abnormal behavior of a member or members of the described group.