Patent Document ID: 20150341376
Application ID: 14287182
Patent Flag: 0

Claim One:
1. A method for detecting an anomaly in a network flow data, comprising: using a processor for: (a) collecting a network flow data within a time interval divided into multiple time-bins, and generating network flow features from the collected network data flow for each time-bin; (b) generating input network traffic matrix containing information for the network flow features for respective time-bins; (c) generating a statistical matrix from the input traffic matrix; (d) applying a principal component analysis to the statistical matrix to determine one or more principal components of the statistical matrix; (e) determining an anomaly score for each time-bin using the principal components; (f) identifying one or more time-bins of the input network traffic matrix having highest anomaly scores; (g) determining mean values for network flow features across all time-bins, excluding the identified time-bins; (h) replacing values of the network flow features in the identified time-bins with respective determined mean values of said network flow features to form a modified input network traffic matrix; (i) replacing the input network traffic matrix with the modified input network traffic matrix, and repeating the steps (c) to (f).