Patent ID: 8683588

Claim:
A method of monitoring for security threats in computer network traffic, the method comprising: monitoring, by a multi-agent system host, a first stream of traffic between a network to be protected and a second network through a first gateway; determining, by the multi-agent system host, whether the first stream of traffic being monitored includes traffic between the network to be protected and a new host in the second network; in response to determining the traffic between the network to be protected and the new host in the second network, accessing, by the multi-agent system host, the new host through a second gateway to generate a second stream of traffic; and comparing, by the multi-agent system host, the first stream of traffic between the network to be protected and the new host through the first gateway and the second stream of traffic between the multi-agent system host and the new host through the second gateway to detect an anomaly therebetween.