Patent Document ID: 20130318611
Application ID: 13710322
Patent Flag: 0

Claim One:
1. A computer-implemented method for detecting a network activity of interest, the method comprising: a) obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include the network activity of interest; b) creating, by the one or more processors, a combined packet from at least a subset of the plurality of TCP packets and IP packets obtained in a), wherein the combined packet comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets; c) obtaining a meta-expression that: comprises a plurality of integers in an order, and corresponds to presence of the network activity of interest in network traffic; d) determining whether the meta-expression obtained in c) appears in the combined packet created in b); e) if the meta-expression obtained in c) appears in the combined packet created in b), then initiating an operation.