Patent Document ID: 20160182552
Application ID: 15056670
Patent Status: 0

Claim One:
1. A method of identifying potential threats on a network, the method comprising: monitoring, by a processor of a system comprising the processor and a memory, communications between endpoints on the network; aggregating, by the processor of the system, the communications between the endpoints into traffic data, wherein the traffic data comprises a plurality of log entries, and wherein each of the plurality of log entries comprises information identifying a corresponding transport protocol used for each of the communications between the endpoints; storing, by the processor of the system, the traffic data; grouping, by the processor of the system, the traffic data between the endpoints on the network based on a key value; calculating, by the processor of the system, a first set of metric values for the traffic data grouped according to the key value and calculating, by the processor of the system, a second set of metric values for the traffic data grouped according to the key value; fitting, by the processor of the system, a first mixture distribution to the first set of metric values and a second mixture distribution to the second set of metric values; identifying, by the processor of the system, an endpoint from the endpoints as an outlier, wherein the endpoint identified as the outlier is associated with a metric value from the first set of metric values that does not fit the first mixture distribution and is associated with a metric value from the second set of metric values that does not fit the second mixture distribution; and providing, by the processor of the system, the endpoint identified as the outlier to a threat management system to provide an alarm associated with identification of the endpoint as the outlier.