Patent ID: 7631355

Claim:
A method of identifying abnormal behavior in activity occurring over a network comprising a plurality of network elements, each network element having a network element identifier, the method comprising: maintaining one or more group profiles of network activity, each group profile being associated with a plurality of network element identifiers; accumulating values of a first function of the contents of an input data stream over a first period of time in each group profile so as to profile the behavior of a respective first portion of the network corresponding to the network element identifiers associated with the respective group profile, the contents of the data stream including at least one field containing a network element identifier and other information related to activity over the respective network element having the respective network element identifier; comparing the accumulated values of each group profile with a corresponding collation threshold and determining whether each group profile at least reaches the corresponding collation threshold; creating a plurality of collation profiles for each group profile that reaches the collation threshold, each collation profile being associated with one or more network element identifiers from the plurality of network element identifiers corresponding to the group profile that caused the creation of the corresponding collation profiles; accumulating values of a second function of the contents of the input data stream in each collation profile over a second period of time so as to profile behavior of a respective second portion of the network corresponding to one or more of the network element identifiers associated with the respective collation profile; and identifying abnormal behavior in activity over each second portion of the network by checking whether each of the accumulated values of the collation profiles meets an abnormal behavior criterion.