Method, data processing device and computer network for anomaly detection

摘要

In order to show a new and improved way for detecting anomalous behavior within a computer network, wherein in particular the rate of false positive detections is reduced, the invention proposes a method for detecting an anomalous operation within a computer network (10) with multiple data processing nodes (101-103, 201, 202, 210) which for the purpose of data communication are interconnected, wherein by a first data processing node (101; 102; 103) of the computer network (10) a first status value is determined, which is a measure for the probability of an anomalous operation, by at least one second data processing node (102, 103; 101, 103; 101, 102) of the computer network (10) a second status value is determined, which is a measure for the probability of an anomalous operation, said second status value is transmitted from the at least one second data processing node (102, 103;, 101, 103; 101, 102) to the first data processing node (101; 102; 103) via a peer-to-peer communication, from said first and second status values a third status value is determined by the first data processing node (101; 102; 103), and in dependence of the third status value it is determined whether an anomalous operation has occurred.;The invention further proposes a data processing device and a computer network adapted to perform the method.