Patent Document ID: 8468599
Application ID: 12885723
Patent Flag: 1

Claim One:
1. A method performed by a computer that has been programmed with instructions that cause the computer to function as a threat-monitoring device for determining, within a deployed environment over a data communication network, network threats and their associated behaviors, the method comprising: acquiring sensor data that identifies a specific contact; normalizing the acquired sensor data to generate transformed sensor data; deriving, for the specific contact from the transformed sensor data using temporal aggregation, a contact behavior feature vector for each of a plurality of time periods; determining, for the specific contact from the contact behavior feature vector, scores associated with each of a plurality of classification modules to form a contact score vector, the contact score vector being independent of an identity of the specific contact; identifying a type of the specific contact based on the contact score vector; and determining, by the threat-monitoring device, a threat type, based on the contact behavioral feature vector and the contact score vector, when the type of the specific contact is determined to be a threat in the identifying step.