Patent ID: 11949695
Assignee: THE BOEING COMPANY
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 13:
14. A method for detecting malicious traffic flows in a network, the method implemented by a computer system including at least one processor in communication with at least one memory device, wherein the method comprises:
receiving, by the processor, packet information for a plurality of data packets transmitted over the network;
calculating, by the processor, inter-arrival times for the plurality of data packets based on the packet information;
calculating, by the processor, packet durations for the plurality of data packets based on the packet information;
filtering, by the processor, the packet information to remove noise;
generating, by the processor, at least one histogram based on the packet information, the inter-arrival times, and the packet durations;
generating, by the processor, a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations;
analyzing, by the processor, the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows; and
reporting, by the processor, the one or more unexpected data flows.