Patent ID: 8543693

Claim:
A system for detecting aberrant network, comprising: a first network interface coupled to one or more clients, wherein the system is configured to: receive network communications at the first network interface, wherein each of the network communications is associated with a first client; determine if aberrant network behavior is occurring with respect to the first client, wherein determining if network behavior is aberrant comprises: analyzing the received network communications to determine if a first rule of any of one or more rules corresponding to the network communications associated with the first client, updating a first set of statistical information associated with the first client responsive to a determination that the first rule, corresponding to the network communications, wherein the first set of statistical information is accumulated over a time period, and analyzing the first set of statistical information to determine if aberrant network behavior is occurring with respect to the first client by applying a set of conditions to the first set of statistical information, each of the set of conditions corresponding to aberrant network behavior and comprising a threshold to be applied to at least a portion of the statistical information.