Patent Document ID: 10084752
Application ID: 15054692
Patent Flag: 1

Claim One:
1. A method for analyzing network communications on a network, the method performed by one or more computing devices connected to the network, the method comprising: receiving, via the network, by the one or more computing devices, summary reports each indicating a set of local topmost packet features identified by in-line packet inspection performed at respective hosts on the network, each summary report indicating a set of local topmost frequently occurring packet features identified at a corresponding host, wherein the hosts are connected to or comprise respective packet processing units, each packet processing unit performing the in-line packet inspection for packets of flows that terminate at the hosts and identifying the topmost packet features for its respective host while intermediating packets between its respective host and the network; combining the summary reports to determine a set of global topmost packet features among the packet features collectively reported in the summary reports; and automatically selecting a mitigation action based on the determined set of global topmost packet features.