a match occurs the optional stateful characteristics specification 630 comprises for example a series of stateful characteristic identifier stateful characteristic value and persistent state tuples where each tuple identifies a type of stateful characteristic and a value to be matched and includes persistent state information so that checks can be made across packets for example the stateful characteristic identifier and stateful characteristic identifier pair may specify that if 1000 instances of a particular packet are received in a 1 second interval then a match occurs the directive 699 specifies how the packet should be handled if the packet data metadata and stateful characteristics specifications result in a match with a packet the directive 699 may have for example two values one value to signify that the packet trigger an alert and as second value to indicate that the packet should not trigger an alert the exemplary procedure followed by the state machine module 270 while in learning phase is shown in as a flow diagram in fig7 at block 705 the process begins at block 710 the system receives an input vector from for example the data collection module 250 the vector represents data fields and metadata from a packet in a normal sequence of packets at block 715 the system applies the clustering algorithm to the received vector resulting in a numerical value that is termed the u201c initial state u201d and is also the u201c current state u201d at block 720 the system selects the entry in the network behavior state machine 275 table that corresponds to the initial state at block 725 the system receives either another vector and.