METHOD AND APPARATUS FOR DETECTING ANOMALOUS NETWORK ACTIVITIES

A method and apparatus for detecting an anomalous activity in a communications network is described. In one example, short-term event data is received from a plurality of servers. An event detection rule is then executed to process the short-term event data over a predefined time period. Afterwards, at least one alarm message is generated in response to detecting the anomalous activity in accordance with at least one predefined long-term security data mining program. In response, the at least one alarm message is provided to at least one of the plurality of servers.