Patent ID: 7969893

Claim:
A method for identifying deviations in patterns of data traffic between host devices communicating over a network, comprising: (a) establishing a baseline traffic distribution by categorizing data traffic during a learning period, wherein the baseline traffic distribution comprises a list of categories, a metric value for each category in the list, and a measure of variability of the metric value for each category in the list; (b) generating an observed traffic distribution by categorizing data traffic during an observation period, wherein the observed traffic distribution comprises a list of categories and a metric value associated with each category in the list; (c) determining whether the observed traffic distribution deviates significantly from the baseline traffic distribution by pair-wise comparing the metric values of the categories of the observed traffic distribution with respective thresholds established for corresponding categories of the baseline traffic distribution, wherein the thresholds are a computed as a function of the metric values and the measures of variability in the baseline traffic distribution; and (d) generating an alarm in response to at least one of the metric values of the categories of the observed traffic distribution being outside a respective threshold.