METHOD FOR MONITORING NETWORK ACTIVITY OF COMPUTER NETWORK NODES Russian patent published in 2023 - IPC G06F21/50 H04L41/06 

FIELD: computer technology.

SUBSTANCE: method for monitoring the network activity of computer network nodes contains the following steps: forming the first and second groups of clusters of states of computer network nodes for the first and second time intervals; generating for each node a characteristic vector, the elements of which are represented by the frequencies of occurrence of network protocols used by the network node within the time interval; transferring the generated vectors to a clustering tool capable of forming a group of clusters of states of computer network nodes based on the frequency of use of network protocols within a time interval; forming on the clustering means mixed groups of state clusters, each of which includes a first group of state clusters and one of the characteristic vectors from the second group of state clusters; searching for deviations between node states within mixed groups of state clusters; determining the degree of criticality of each detected deviation; transmitting a control signal to a means for generating a response to deviation.

EFFECT: providing the ability to respond to detected anomalous activity of computer network nodes.

12 cl, 21 dwg, 1 tbl