Abstract: Method and apparatus for port sweep detection in a network is described. In one example, log data is obtained for a period of time. The log data is associated with a plurality of devices in the network. The log data is processed to identify connection requests from a source key for a port at a number of target internet protocol (IP) addresses. An alarm is generated if the number of target IP addresses associated with the connection requests from the source key exceeds a threshold.

Abstract: A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate.

Abstract: Method and apparatus for analyzing source Internet protocol (SIP) activity in a network is described. In one example, a SIP address is obtained. Log data collected over a predefined time period by a plurality of network facilities is automatically queried using the SIP address as parametric input to generate a report. The report includes sample activity for the SIP and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.

Abstract: Method and apparatus for analyzing source internet protocol (SIP) activity in a network is described. In one example, a SIP address is obtained. Log data collected over a predefined time period by a plurality of network facilities is automatically queried using the SIP address as parametric input to generate a report. The report includes sample activity for the SIP and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.