Patent Document ID: 8085681
Application ID: 12255037
Patent Flag: 1

Claim One:
1. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, when executed by a computer, cause the computer to at least: receive and store a first plurality of packets identified by a plurality of packet-detecting devices within a network; define a baseline behavior pattern applicable to a behavior of the network; define a threshold applicable to a deviation of the behavior of the network from the baseline behavior pattern; perform a first analysis of the first plurality of packets to identify a first abnormal deviation in the baseline behavior pattern that exceeds the threshold; identify a first attack against the network, as exhibited by the first abnormal deviation; provide a first remedy for the first abnormal deviation to recover from the first attack; receive and store a second plurality of packets identified by the plurality of packet-detecting devices within the network; perform a second analysis of the second plurality of packets to identify a second abnormal deviation in the baseline behavior pattern that exceeds the threshold; identify a second attack against the network, as exhibited by the second abnormal deviation; compare the second plurality of packets to the first remedy to determine that the second abnormal deviation is caused by a change from first attack tactics used for the first attack to second attack tactics used for the second attack, the first attack tactics being changed to the second attack tactics in response to the first remedy; and provide a second remedy based on the change from the first attack tactics to the second attack tactics.