Patent Document ID: 7903566
Application ID: 12195333

Base Claim:
1. A computer-based method for detecting anomalies in the traffic passing through an internet protocol (IP) network, said method comprising: extracting, from a database, a single instance of each unique packet header associated with a plurality of IP-to-IP packets, the IP-to-IP packets having been transmitted across the IP network over a predefined period of time; analyzing by a computer the packet headers to identify anomalous conversations based on at least one of a conversation uniqueness, a time of week uniqueness, and a data quantity uniqueness; and providing by the computer alerts corresponding to detected anomalous conversations.

---

Claim 2:
2. The method of claim 1 , wherein said analyzing the packet headers to identify anomalous conversations based on a conversation uniqueness comprises determining whether a particular conversation has been conducted on the IP network over a historical and statistically relevant period based on an IP-to-IP-on-Port conversation tuple.