Patent ID: 11902121
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. A system comprising:
a non-transitory computer-readable memory storing instructions;
a processor programmed to cooperate with the instructions in memory to perform operations comprising:
first capturing first data associated with a first packet flow originating from a computing device, the first capturing occurring at first layer of a network;
second capturing second data associated with a second packet flow originating from the computing device, the second capturing occurring at a second layer of the network different from the first layer;
in response to a difference between the first and second data exceeding a threshold value;
determining a portion of the second data includes hidden network traffic transmitted by bypassing an operating stack of the computing device or a packet capture agent of the computing device; and
performing a corrective action to reduce future flow of hidden traffic from the computer device.