US Patent 7894350 Global network monitoring

Systems, methods and apparatus monitor networks to identify when the networks are not operating normally, for instance, because of malware. During a sample interval sample data is collected that corresponds to a plurality of system activities, the sample data collected from a plurality of monitored networks and representing normal operations of the plurality of monitored networks. Subsequent to the sample interval, observed data is collected from the plurality of monitored networks, the observed data corresponding to at least some of the system activities. A determination is made whether the observed data represents the normal operation of the monitored networks, and an alert is generated if the observed data does not represent the normal operation of the monitored networks.