Patent Document ID: 7962611
Application ID: 12056583
Patent Flag: 1

Claim One:
1. In a computer system having a processor, a method for detecting flow-level network traffic anomalies, wherein the processor performs the method comprising: obtaining current distributions of flow level traffic features within the computer system; computing a distance of the current distributions from a distributions model, wherein the distance includes a component-wise analysis layer and a feature-wise analysis layer, wherein the component-wise layer measures how close flow level traffic behavior observed in each component of the flow level traffic features matches learned behavior modes, thereby detecting changes that affect individual components, and wherein the feature-wise layer identifies abnormal behavior by accumulating the component-wise distances to a single index in each of the flow level traffic features; comparing the distance of the current distributions to a distance baseline from the distributions model; determining if the distance is above a pre-determined threshold; in response to the distance being above the pre-determined threshold, identifying the distance to be an anomaly; and in response to the distance being below the pre-determined threshold, identifying the distance to be within normal operation of a computer network under observation.