Abstract: A method of analyzing network traffic comprising the steps of providing reference network traffic information associated with a remote access server and obtaining current network traffic information associated with the remote access server. Current network traffic information is analyzed using statistical analysis to determine whether values of the current network traffic information are within or outside a statistical range associated with the reference network traffic information. If a value of the current network traffic information is outside the statistical range, the value of the current network traffic information is an outlier which is included in an outlier information table, and an alert is generated. If a value of the current network traffic information is within the statistical range, a similarity value between the value of the current traffic information and outliers is determined. An action is then performed.

Abstract: A method of analysing network traffic comprising the steps of providing reference network traffic information associated with a remote access server and obtaining current network traffic information associated with the remote access server. Current network traffic information is analysed using statistical analysis to determine whether values of the current network traffic information are within or outside a statistical range associated with the reference network traffic information. If a value of the current network traffic information is outside the statistical range, the value of the current network traffic information is an outlier which is included in an outlier information table, and an alert is generated. If a value of the current network traffic information is within the statistical range, a similarity value between the value of the current traffic information and outliers is determined. An action is then performed.