Patent ID: 7500266

Claim:
A network intrusion detection device comprising: a memory configured to store instructions; and a processor configured to execute the instructions to: receive information relating to an activity between one of a plurality of source devices and one or more services of destination devices, measure a behavior of activity of the one source device in terms of independence and uniformity of access to the one or more services, and identify probing based on the measured behavior and not based on a priori knowledge of attack signatures by: accessing a joint probability table comprising entries relating to connection or connection attempts by certain of said plurality of source devices, certain of said entries identifying said one source device, a destination device, and a destination service as a set of identification information, the joint probability table recording a ratio of occurrence of said set of said identification information to the total number of occurrences of all sets of said identification information thereby representing a probability of occurrence for said set of said identification information, and clustering together with said one source device other of said plurality of source devices contributing to identification information having probability of occurrence similar to said probability of occurrence to obtain clustered source devices identified as probing devices from which a cluster report is created to identify new attack signatures.