A computer-automated method of hierarchical event monitoring and analysis within an enterprise network including deploying network monitors in the enterprise network, detecting, by the network monitors, suspicious network activity based on analysis of network traffic data selected from the following...http://www.google.de/patents/US6484203?utm_source=gb-gplus-sharePatent US6484203 - Hierarchical event monitoring and analysis
