Patent Document ID: 8856324
Application ID: 13752268
Patent Flag: 1

Claim One:
1. A computer-implemented method for detecting a computing device that is compromised by an undetected attack, the method comprising: obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include: network packets containing a known attack on the computing device, the known attack different from the undetected attack, network packets from the computing device before the known attack, and network packets from the computing device after the known attack; creating, by the one or more processors, a plurality of combined packets from at least a subset of the plurality of TCP packets and IP packets, wherein: a first combined packet of the plurality of combined packets comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets, and a second combined packet of the plurality of combined packets comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets, wherein the second combined packet is different from the first combined packet; creating, by the one or more processors, a first sequence by converting bitwise content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting bitwise content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining, by the one or more processors, a similarity metric between the first sequence and the second sequence based on a distance function; creating, by the one or more processors, a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in the first order; creating, by the one or more processors, a fourth sequence, wherein the fourth sequence is a meta-expression that: comprises a subset of the third plurality of integers of the third list, in the first order, and represents that the computing device is compromised by an attack; and storing the meta-expression, wherein the stored meta-expression is used to detect that the computing device is compromised by the undetected attack.