Patent Document ID: 9094444
Application ID: 13143062
Patent Flag: 1

Claim One:
1. An anomaly detection method for a packet-based network, the packet-based network comprising several network resources, the method comprising: forming training feature vectors based on network resources monitored and ordered during a training period; obtaining, based on the training feature vectors, a first vector of a first network resource category comprising a sequence of network resources belonging to the first network resource category; monitoring the network resources of the packet-based network, wherein the monitored network resources belong to two or more network resource categories; forming two or more sequences of network resources comprising a first sequence of network resources belonging to a first network resource category and a second sequence of network resources belonging to a second network resource category, wherein network resources in each sequence are ordered based on a respective amount of data traffic generated or received by each monitored network resource; forming a detection feature vector for the first network resource category based on the sequence of network resources belonging to the first network resource category; determining at least one difference in position of at least one network resource between a position of the least one network resource in the first vector and a position of the at least one network resource in the detection vector; and detecting an anomaly in the packet-based network based on the at least one difference in position of the at least one network resource.