Patent Document ID: 10069849
Application ID: 14929184
Patent Flag: 1

Claim One:
1. A method comprising: detecting, by a computer system, outgoing traffic from a computer device, the outgoing traffic being indicative of a plurality of connection requests and being user-generated traffic or machine generated traffic; forming, by the computer system, a plurality of groups of the traffic indicative of the plurality of connection requests; determining, by the computer system, whether a particular group of the groups corresponds to user-generated traffic or machine generated traffic based on a periodicity of traffic indicative of connection requests determined as a function of a timing between traffic indicative of connection requests in the particular group and a plurality of connection parameters associated with the traffic indicative of connection requests in the particular group; and responsive to a determination that the particular group is machine generated traffic, determining, by the computer system, whether the particular group of traffic indicative of connection requests represents an anomaly based on a frequency at which the particular group of traffic indicative of connection requests has occurred for the outgoing traffic.