Patent Document ID: 9843596
Application ID: 14791269
Patent Flag: 1

Claim One:
1. A method, comprising: a) obtaining a data set of network traffic comprising N-dimensional data points from a traffic analyzer, wherein N>3 and wherein the traffic analyzer is configured to generate a statistics matrix comprising the N-dimensional data points; b) by a computer, i. processing the statistics matrix into a Markov kernel matrix, ii. processing the Markov kernel matrix to obtain processed data points with a dimension r lower than N, wherein the processing includes finding r discriminating eigenvectors by providing i=1,. .. , r eigenvalues and respective associated eigenvectors, generating for each i=2,. .. , r a respective i th cluster based on the i th eigenvector and generating other respective clusters based on eigenvectors 1,. .. , i−1, i+1,. .. , r, computing a distance between each respective i th cluster based on the i th eigenvector and each of the other respective clusters based on eigenvectors 1,. .. , i−1, i−1,. .. , r, and finding r eigenvalues and associated respective eigenvectors that provide the highest distance, the associated respective eigenvectors that provide the highest distance being the discriminating eigenvectors, wherein the r discriminating eigenvectors thus found form an embedded space in which processed data points with a reduced dimension r form a normal cluster, iii. detecting an abnormal data point in the processed data points with a dimension r lower than N without relying on a signature of a threat and without use of a threshold, and iv. blocking the abnormal data point.