Patent Document ID: 20100290346
Application ID: 12516766
Patent Flag: 0

Claim One:
1. A network traffic anomaly detector ( 30 ) comprising: a network interface ( 50 ) connecting to a network ( 10 ) to be monitored to extract multiple network traffic statistics ( 52 ), each as a time series; a first analyzer ( 54 ) receiving the network traffic statistics ( 52 ) to characterize a variability of the network traffic statistics; a second analyzer ( 68 ) receiving the network traffic statistics ( 52 ) to characterize a correspondence between different network traffic statistics; and a detection unit ( 44 ) receiving the variability and correspondence characterizations ( 58 , 76 ) from the first and second analyzer ( 54 , 68 ) to provide an output ( 66 ) indicating a likelihood of a network anomaly.