Patent Document ID: 9055093
Application ID: 12317056
Patent Status: 1

Claim One:
1. A method of detecting security threats in a computer network, the method comprising: receiving a data stream which represents outbound, HTTP messages from a first computer application to at least one second computer application wherein the computer applications are implemented on one or more computers; specifying one or more legitimate applications; establishing a behavioral profile whitelist for the one or more legitimate applications, the behavioral profile whitelist having entries containing metadata, the entries describing at least one expected possible characteristic of legitimate messages that may be sent by the one or more legitimate applications, the at least one expected possible characteristic including an expected possible content characteristic, the expected possible content characteristic being determined by processing a message to extract a plurality of message fields, matching each field against patterns specified by the whitelist entries, and indicating the presence of fields that do not match a whitelist entry; monitoring the data stream to detect a security threat based on the HTTP messages exhibiting behavior not characterized by the expected possible content characteristic in the behavioral profile whitelist; and generating a signal if a security threat is detected; wherein the metadata contains alert filters that specify sets of alerts to match; wherein each whitelist entry includes a matching section which specifies which alert the entry matches and an action which associates alerts that match the entry with a particular application that sent a given HTTP message; and wherein the whitelist comprises a mapping from the metadata to legitimate applications.