CPC H04L 63/1416 (2013.01) [H04L 63/166 (2013.01); H04L 63/168 (2013.01); H04L 63/1441 (2013.01)] | 19 Claims |
1. A method of intruder detection, comprising:
intercepting communications for a data source in an organization;
analyzing the communications to identify an intruder detection signature, the analyzing including
determining whether at least a portion of the communications match a behavioral baseline for the data source, the behavioral baseline being dynamically updated using the communications;
determining an intrusion for a communication of the communications based on the intruder detection signature, the determining the intrusion including identifying at least one of the communications as matching the intruder detection signature in response to the at least one of the communications failing to match the behavioral baseline; and
generating an alarm based on the intrusion.
|