Patent Document ID: 9712548
Application ID: 14524145
Patent Flag: 1

Claim One:
1. A computer implemented method for managing a parallel profiling paradigm for a common network entity in a network, comprising: using at least one hardware processor of at least one server for: building, based on analysis of actions documented in an input data and associated with a network entity in a computer network, a first entity behavioral profile for said network entity, said first entity behavioral profile reflects first metrics associated with behavioral characteristics of said network entity; monitoring additional actions in additional input data to identify one or more anomalies from said first entity behavioral profile; using said one or more anomalies as a regular sample for building at least one second entity behavioral profile for said network entity; wherein said first entity behavioral profile and said at least one second entity behavior profile are representations of expected behaviors of the network entity, said at least one second entity behavioral profile reflects second metrics associated with said behavioral characteristics of said network entity, wherein said first metrics and said second metrics are different from one another and said behavioral characteristics comprise at least two members of a group consisting of: time of day or time of week of network events of by said network entity, access distribution of said network entity, distribution of originating internet protocol (IP) addresses of said network entity, a rate of access to a target by said network entity, a rate of input by of said network entity, a geographical location of said network entity, and type of network events initiated by of said network entity; managing said first entity behavioral profile and said at least one second entity behavioral profile in parallel for analysis of further additional actions of said network entity in said computer network; calculating, according to at least one of: said first entity behavioral profile and said second entity behavioral profile, a leading entity behavioral profile for said network entity; and using said leading entity behavioral profile for a detection of further anomalies in said further additional actions of said network entity in said computer network.