Abstract:
Network security monitoring for external threats is provided that is based on rich metadata collected from internal network traffic that is analyzed for anomalies against a behvior baseline to detect the external threats. Rich metadata includes but is not limited to the information typically found in the headers of every layer of telecommunication protocols describing the communication between network entities.