Detecting anomalous network device activity

1. A method for detecting anomalous network device activity, the method comprising:

receiving, using an interface, pre-existing traffic data associated with a host device;

analyzing, using a processor executing instructions stored on a memory, the pre-existing traffic data associated with the host device;

assigning, using the processor, an identification label to the host device based on the pre-existing traffic data;

assigning an expected behavioral parameter to the host device based on the identification label;

detecting the pre-existing traffic data deviates from the expected behavioral parameter;

classifying the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter; and

issuing, using the processor, an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.

2. The method of claim 1 wherein analyzing the pre-existing traffic data includes analyzing at least one of source connection metadata and destination connection metadata.

3. The method of claim 1 wherein the identification label is based on previously-labeled host devices so that similar host devices with respect to traffic data are similarly labeled.

4. The method of claim 1 wherein analyzing the pre-existing traffic data associated with the host device includes determining the host device is a destination address for a web connection, and assigning the identification label includes labeling the host device as a web server.

5. The method of claim 1 wherein the pre-existing traffic data includes communication ports used by the host device.

6. The method of claim 1 wherein the host device is selected from the group consisting of a computer, laptop, router, firewall, phone, and server.

7. The method of claim 1 wherein the host device is a medical monitoring device.

8. A system for detecting anomalous network device activity, the system comprising:

an interface for receiving at least pre-existing traffic data associated with a host device; and

a memory and a processor executing instructions stored on the memory to:

analyze the pre-existing traffic data associated with the host device;

assign an identification label to the host device based on the pre-existing traffic data;

assign an expected behavioral parameter to the host device based on the identification label;

detect the pre-existing traffic data deviates from the expected behavioral parameter;

classify the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter; and

issue an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.

9. The system of claim 8 wherein the processor is configured to analyze the pre-existing traffic data by analyzing at least one of source connection metadata and destination connection metadata.

10. The system of claim 8 wherein the identification label is based on previously-labeled host devices so that similar host devices with respect to traffic data are similarly labeled.

11. The system of claim 8 wherein the processor is further configured to determine the host device is a destination address for a web connection based on the pre-existing traffic data, and label the host device as a web server.

12. The system of claim 8 wherein the pre-existing traffic data includes communication ports used by the host device.

13. The system of claim 8 wherein the host device is selected from the group consisting of a computer, laptop, router, firewall, phone, and server.

14. The system of claim 8 wherein the host device is a medical monitoring device.