Importance

Loading Importance Indicators...

Abstract

The invention relates to a method and a system for detecting a single data flow in an aggregate packet data flow and identifying the application generating the single data flow, this single data flow being divided into messages, each message comprising a plurality of blocks, each block (g) having n bits for identifying 2ⁿ block values (i). The method comprises the steps of providing, for each block value (i), an expected frequency value (E_i), measuring, for a predefined number (G) of blocks (g), the values Formula (I) of frequency with which each block (g) identifies each block value (i) so as to obtain a plurality of measured frequency values Formula (I), processing, for each block (g), the measured frequency values Formula (I) and the expected frequency values (E_i) in order to generate a frequency deviation value Formula (II) representative of the deviation of the measured frequency values Formula (I) with respect to the expected frequency values (E_i), and processing the frequency deviation values Formula (II) generated for each block (g) with at least one frequency deviation threshold value (χ_th) in order to detect the single data flow and identify the application generating said single data flow.

Loading the Abstract Image...

First Claim