Use of DNS requests and host agents for path exploration and anomaly / change detection and network status recognition for anomaly subgraph detection

摘要

A computer-implemented method (600), comprising:collecting (620) data, by a computing system (102), from a plurality of host agents pertaining to network communications sent and received by respective hosts in a network;analyzing (630), by the computing system, the collected data to detect anomalous behavior during a predetermined time period by applying a statistical model to a plurality of-paths in a graph on a sliding window basis; andwhen anomalous behavior is detected, providing (660), by the computing system (102), an indication that the anomalous behavior occurred during the predetermined time period.