Patent ID: 7712134

Claim:
A method for detecting a virus of a network, comprising the steps of: determining a plurality of metrics to represent relative uncertainties of a plurality of traffic features; determining, using a computer system and for a time window of a plurality of time windows, a plurality of divergences each representing a difference, within the time window, between a pair of metrics among the plurality of metrics; determining, using the computer system, a global metric to represent a maximum one of the plurality of divergences for the time window; monitoring, using the computer system and over the plurality of time windows, traffic in the network using the global metric; identifying one or more network traffic anomaly in real time when the global metric exceeds a pre-determined threshold; analyzing the one or more network traffic anomaly to generate an analysis in real time; and determining the network virus based on the analysis in real time, wherein the global metric is determined by calculating Max-PMER as a ratio R i for an i th time window of the plurality of time windows when the traffic of the network is monitored, wherein Max-PMER is calculated according to: R i = max ( x , y ) ∈ K ⁢ R i x , y = H i x H i y Avg ⁡ ( H i x H i y ) Avg ⁡ ( H i x H i y ) = 1 / N S ⁢ ∑ k = i - N S i - 1 ⁢ ⁢ H k x H k y where K represents the plurality of metrics, x and y represent a pair of metrics exhibiting highest divergence in the plurality of metrics within the i th time window, H i x and H i y represent entropies of x and y, respectively in the i th time window, H k x and H k y represent entropies of x and y, respectively in the k th time window, and N S represents a pre-determined number of consecutive time windows prior to the i th time window.