Patent ID: 7639714

Claim:
A method, implemented on a processor, of detecting anomalous payloads transmitted through a network, comprising the steps of: receiving at least one payload within the network; determining, using the processor, a length for data contained in the at least one payload; generating, using the processor, a byte value statistical distribution of data contained in the at least one payload received within the network; selecting, using the processor, from a plurality of model byte value statistical distributions, a model byte value statistical distribution representative of normal payloads transmitted through the network based at least in part on the determined length, wherein the model byte value statistical distribution has a predetermined length range and is selected such that the determined length for the data contained in the at least one payload is included within the predetermined length range; comparing, using the processor, at least one portion of the generated statistical distribution to a corresponding portion of a selected model distribution; and identifying, using the processor, whether the at least one payload is an anomalous payload based, at least in part, on differences detected between the at least one portion of the byte value statistical distribution for the at least one payload and the corresponding portion of the selected model distribution.