Patent ID: 11949695
Assignee: THE BOEING COMPANY
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 18:
19. A system for detecting malicious traffic flows in a network comprising a computer system including at least one processor in communication with at least one memory device, wherein the at least one processor is programmed to:
receive a security policy to execute on the system, wherein the security policy includes configuration data;
receive packet information for a plurality of data packets transmitted over the network;
calculate inter-arrival times for the plurality of data packets based on the packet information and the security policy;
calculate, by the processor, packet durations for the plurality of data packets based on the packet information;
filter the packet information to remove noise based on the security policy;
generate at least one histogram based on the packet information, the inter-arrival times, and the packet durations;
generate a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations;
analyze the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows based on the security policy; and
report the one or more unexpected data flows.