System and method for network intrusion detection anomaly risk scoring

摘要

Systems, methods, and computer-readable storage media for scoring network anomaly risk. A system identifies a baseline usage for a facet of a server and determines, for the facet, a normal range of use based on the baseline usage. The system also determines an abnormal range of use based on the baseline usage. When actual usage data is available, the system determines whether the usage data corresponds to the normal range of use or the abnormal range of use, and calculates a facet score based on the abnormality value.