Patent ID: 8001583

Claim:
A method for detecting an anomaly in a network comprising: a feature value generating step for counting the number of packets per each time slot for each traffic type defined by classifying packets to k types (k is a natural number equal to or larger than 2) according to types including protocols and flags with respect to network traffic, and generating feature values, consisting of time sequence data for each time slot, classified by the traffic type (k types); a correlation coefficient calculating step for calculating correlation coefficients between each pair of two feature values chosen from the feature values classified by k type via the feature value generating step for each time range pre-specified and generating the time sequence data of the correlation coefficients; a histogram generating step for generating histograms representing the occurrence probabilities of individual correlation coefficients obtained via the correlation coefficient calculating step for each classes pre-specified as range of the correlation coefficients, by plotting the frequency of the correlation coefficients over individual classes and dividing the frequency of the correlation coefficients over individual classes with the total of the frequency; and an anomaly severity determining step for defining normal correlation coefficient histograms generated via the histogram generating step, determining the severity of an anomaly of an anomaly of the correlation coefficient obtained via the correlation coefficient calculating step using the normal correlation coefficient histograms, the method further comprising: a state similarity evaluating step for expressing the correlation coefficients obtained via the correlation coefficient calculating step as matrices; converting the matrices consisting of correlation coefficients into matrices consisting of probability distribution vectors, defining plural probability distribution vectors representing a similar anomaly as a single profile, and evaluating an anomaly of the matrix by comparing the matrix with the profile; a visualizing step for expressing the occurrence probabilities of correlation coefficients calculated by the state similarity evaluating step as the matrix and assigning colors to each element of the matrix according to the occurrence probabilities of the matrix for the visualization of the matrix.