Patent Document ID: 8639797
Application ID: 12180243
Patent Flag: 1

Claim One:
1. A method, including steps of maintaining, at a network monitoring device, information regarding long-term historical activity of a network; maintaining information regarding short-term activity of that network; receiving information regarding recent activity of that network; comparing that information regarding recent activity with that information regarding long-term activity, and determining the presence of abnormal activity in response to a result of said steps of comparing recent with long-term activity; comparing that information regarding recent activity with that information regarding short-term activity, determining the presence of changes in network activity in response to a result of said steps of comparing recent with short-term activity, and updating that short-term activity if and only if that information regarding recent activity is within normal behavior for that network; comparing that information regarding short-term activity with that information regarding long-term activity, and determining the presence of changes in network activity in response to a result of said steps of comparing short-term with long-term activity, and updating that long-term activity using that recent activity if and only if that information regarding recent activity is within normal behavior for that network.