Patent ID: 9392319
Filing Date: 2016-07-12
CPC Classification: G06F,H04L,H04N

Claim Text:
1. A method for performing device profiling on a secure device, the method comprising: instantiating at least two counters on the secure device; receiving, at the secure device, a first plurality of messages in a first data stream; processing, by the secure device, a first message of the first plurality of messages; determining that the first processed message has a first type; based upon the determination that the first message has the first type, adjusting a first counter related to the first type; processing, by the secure device, a second message of the first plurality of messages; determining that the second processed message has a second type, the second type different from the first type; based upon the determination that the second message has the second type, adjusting a second counter related to the second type; processing, by the secure device, a third message of the first plurality of messages; determining that a third message is a subtype of the second message; based upon the determination, adjusting a third counter related to the subtype; determining whether to perform profiling of the secure device; and when it is determined that profiling should be performed, performing operations comprising: when the second ratio does not meet the second threshold, executing the at least one countermeasure.