Hewlett Packard Enterprise Development LP

Trend Micro Inc.

Yordanos Beyene

Chin-En Yang

Catherine S Curtis

Network threat events are declared in response to detecting network traffic data indicative of network threats in network traffic involving hosts of a private computer network. Common hosts of the private computer network are identified in network threat events that have occurred within a sampling period. For each identified common host, a baseline of network behavior of the common host in network threat events that have occurred within a sliding time window is generated. A new threat event that has occurred after the sliding time window is identified as anomalous by comparing a network behavior of a common host in the new network threat event against the baseline of network behavior of the common host. An alert is issued in response to detecting an anomalous network threat event that has a risk rating that exceeds a threshold risk level.

System and method for identifying anomalous network threat events that occur in a private computer network

A traffic profile or description of a mix of different types of traffic is provided to compute, using a model, a performance characteristic of a network device. The model relates a performance characteristic of the network device to parameters associated with different types of traffic.

Growing community of inventors

Roseville, CA, United States of America

Yordanos Beyene