Patent Description:
Communication systems, including communication satellites, are potential targets for malicious actors. Detecting intrusions by these malicious actors can be difficult as monitoring every communication between satellites and other communication systems may not be practical as the configurations and topology of the devices and networks can be constantly changing over time.

The scientific paper by <NPL>, according to its abstract, states a technique to detect fast-flux botnet traffic by analyzing network traffic data. The first stage of the technique is to cluster similar packets from traffic data irrespective of their origin, thus separating out traffic from a single botnet in one of the clusters. The second stage is to analyze the timing of the packets using power spectral density to identify any hidden patterns present in them. If similar packets belong to many destination addresses arrive, following a pattern, the traffic can be considered to be suspicious and the host, that originates from these packets, may be infected by a bot with a fast-flux command and control server.

Document <CIT>, according to its abstract, states a mechanism for generating a packet inspection policy for a policy enforcement point in a centralized management environment. Data of a network topology for the policy enforcement point corresponding to a network infrastructure is updated according to metadata of the policy enforcement point, the metadata including a capability of the policy enforcement point. The packet inspection policy for the policy enforcement point is generated according to the data of the network topology and the capability of the policy enforcement point. The packet inspection policy is then deployed to the policy enforcement point.

Furthermore, many of the traffic flows between network devices, such as satellites, and other systems are encrypted, which slows down and potentially prevents analysis of the messages being transmitted. In many situations, the intrusion detection systems need to be able to analyze messages in real-time and to be able to handle messages that are intermittent or are short. Accordingly, additional security or systems that improve the detection capabilities of communication systems would be advantageous.

This Background section is intended to introduce the reader to various aspects of art that may be related to various aspects of the present disclosure, which are described and/or claimed below.

The presently claimed invention is defined by the appended independent claims.

The Figures described below depict various aspects of the systems and methods disclosed therein. It should be understood that each Figure depicts an example of a particular aspect of the disclosed systems and methods, and that each of the Figures is intended to accord with a possible example thereof. Further, wherever possible, the following description refers to the reference numerals included in the following Figures, in which features depicted in multiple Figures are designated with consistent reference numerals.

There are shown in the drawings arrangements, which are presently discussed, it being understood, however, that the present examples are not limited to the precise arrangements and instrumentalities shown, wherein:.

The field relates generally to intrusion detection, and more specifically, to detecting malicious traffic flows in encrypted traffic in a known, controlled, and constantly changing environment. In one example, a communication network analyzer ("CNA") computer device determines a communication network based on the current time and the available communication devices, activates an algorithm with a security policy to monitor the packets transmitted over the communication network. The systems and methods described herein are designed to be able to monitor traffic in real-time while not being dependent on the communication protocols that are in use on the network.

In typical network traffic, various packet types (flows) may not arrive at predetermined rates. This may cause problems with distinguishing spurious packet types with low frequency of arrival using standard techniques. In addition, various packet types may have varying durations, where shorter duration packets can have lower energy and lower signatures when standard techniques are used.

The analysis technique described herein combines power spectral density (PSD) estimation with histogram data to enhance the energy of the packet types (flows) with lower frequency of arrivals or shorter durations to allow for improved detection and analysis of these flows. This analysis technique generates distinct and visible signatures for all packet types (flows) and enhances the signatures of non-periodic and spurious packet arrival times. The analysis technique also reduces the amount of captured data required for effective analysis. In most case, the more accurate analysis required, the more data needed to be fed to the analysis. However, in many situations, such as in real-time analysis, there might not be that much data and/or time to process. By enhancing the signature and visibility of the packets, the amount of data necessary to properly analyze the network traffic can be reduced. By combining the PSD analysis with the histogram data, the system can add resolution and/or accuracy to the information about the packets being analyzed, such as, but not limited to, number of packets in each flow, type of packets, packet size, frequency, and data rates.

The system and methods disclosed herein are described as being executed by a CNA computer device. In one example, the CNA computer device is the dataplane of a switch of a network communication device as traffic is coming through the switch. In other examples, the CNA computer device could also be, but is not limited to, a network card, repeater hub, network bridge, switching hub, bridging hub, MAC bridge, a tap port, or any other device configured to read messages, such as packets, either inside or outside of the dataplane.

The CNA computer device determines information about packets that are arriving from and/or being transmitted to the network. This information includes packet arrival times (seconds), packet length (bits), and packet content bit rate (bits per second). With this information, the CNA computer device analyzes the packets to find the existence of an unwanted series or set of packets by analyzing the presence, shape, form, and/or frequencies of the packets that the CNA computer device is analyzing.

The CNA computer device generates histogram and PSD data based on the information about the packets to compare against the expected flows to detect unexpected data flows in the traffic.

Described herein are computer systems such as the CNA computer devices and related computer systems. As described herein, such computer systems include a processor and a memory. However, any processor in a computer device referred to herein may also refer to one or more processors wherein the processor may be in one computing device or a plurality of computing devices acting in parallel. Additionally, any memory in a computer device referred to herein may also refer to one or more memories wherein the memories may be in one computing device or a plurality of computing devices acting in parallel.

The systems and processes are not limited to the specific examples described herein. In addition, components of each system and each process can be practiced independent and separate from other components and processes described herein. Each component and process also can be used in combination with other assembly packages and processes.

<FIG> illustrates a block diagram of an example communication satellite system <NUM>, in accordance with one example of the present disclosure. The example satellite system <NUM> includes a network processor <NUM>, a storage unit <NUM>, and a payload processor <NUM>, which are all connected to an Ethernet switch <NUM>. The Ethernet switch <NUM> is further connected to one or more bus controllers <NUM>, which facilitate communication with satellite bus subsystems <NUM> and a packet switch <NUM>. In some examples, the packet switch <NUM> is a programmable data plane with security that allows for the execution of algorithms to monitor a plurality of ports <NUM> that are used for communication connections <NUM> from and to the satellite <NUM>. The plurality of connections <NUM> can include, but are not limited to, inter-satellite links (ISL), down links (DL), and ports <NUM> that can act as either ISL or DL.

<FIG> illustrates a block diagram of an example network <NUM> in a first network configuration <NUM> including the example communication satellite system <NUM> (shown in <FIG>). Network <NUM> includes a plurality of satellites <NUM>. As shown in the first network configuration <NUM>, the plurality of satellites <NUM> are at a plurality of orbits, such as geosynchronous earth orbit (GEO) <NUM>, medium earth orbit (MEO) <NUM>, and low earth orbit (LEO) <NUM>. Network <NUM> can also include satellites <NUM> in highly elliptical orbit, lunar orbits, or any other non-geostationary (NGSO) orbit around celestial bodies, where their connections and locations are known and/or can be predicted.

Network <NUM> also includes a plurality of user devices <NUM>. The user devices <NUM> can include aircraft, spacecraft, watercraft, ground-based vehicles, ground stations, and/or space stations, where the user devices <NUM> connect to the network <NUM>.

As shown in the first network configuration <NUM>, the satellites <NUM> each have one or more ISL connections <NUM>. There are also DL connections <NUM> to the satellites <NUM> from the user devices <NUM>. While not shown as directly connected in <FIG>, each DL connection <NUM> connects a user device <NUM> on the network <NUM> to a satellite <NUM>.

Per the nature of satellites <NUM>, the different satellites <NUM> orbit the earth at different rates, such that the satellites <NUM> in the network configuration <NUM> at time A will be different than that at time B. For example, satellites <NUM> in LEO <NUM> will orbit the Earth in <NUM> to <NUM> minutes, while those in MEO <NUM> may take <NUM> hours to complete an orbit. This means that the satellites <NUM> that make up the network <NUM> will change overtime. Accordingly, knowing when the network configuration <NUM> of the network <NUM> will change is important to properly securing and monitoring the network <NUM>.

<FIG> illustrates a block diagram of a transition <NUM> from the first network configuration <NUM> to a second network configuration <NUM>. In the transition <NUM>, the ISL connection <NUM> between satellite #<NUM> and satellite #<NUM> ends and a new ISL connection <NUM> is created between satellite #<NUM> and satellite #<NUM>.

Each network configuration <NUM> and <NUM> represents the network <NUM> at a different point in time. While, the different network configurations <NUM> and <NUM> shown herein are related to satellites, the systems and methods described herein will also work with other types of computer networks <NUM> where multiple user devices <NUM> are connected.

<FIG> illustrates an example algorithm <NUM> for analyzing traffic flow data to detect malicious data flows in the system <NUM> (shown in <FIG>) and other similar system and a network, such as network <NUM> (shown in <FIG>). The steps of algorithm <NUM> are performed by the packet switch <NUM> (shown in <FIG>). The packet switch <NUM> is programmed to monitor data flows transmitted by or received by a port <NUM> (shown in <FIG>). The packet switch <NUM> uses algorithm <NUM> to monitor the data flows on the port <NUM>. In one example, the packet switch <NUM> stores one or more security policies, where the security policies relate to a configuration of the network <NUM>, such as configuration <NUM> and <NUM> (both shown in <FIG>). In at least one example, the security policy includes information about the network configuration and how the traffic is supposed to flow. In some examples, the packet switch <NUM> is co-located with another processor, wherein the co-located processor performs one or more steps of algorithm <NUM>, such as the analysis steps.

The packet switch <NUM> determines three different input packet characteristics based on either data packets received or transmitted. These inputs include, but are not limited to, packet arrival times <NUM>, packet length <NUM>, and packet bit rate <NUM>.

Using the arrival times <NUM>, the packet switch <NUM> computes <NUM> inter-arrival times, which is the duration between the arrival of data packets. The packet switch <NUM> determines the minimum gap length either based on packet statistics or prior knowledge, such as that provided in a security policy. If the distance between adjacent packet arrivals exceeds a predetermined criterion (e.g., threshold amount), the packet switch <NUM> recognizes a gap and reduces the inter-arrival time to the median inter-arrival time. The packet switch <NUM> removes the gap periods since such gaps may introduce distortions in the analysis results. The packet switch <NUM> computes <NUM> the inter-arrival rate and computes the median <NUM> inter-arrival rate. The inter-arrival rate and the median inter-arrival rate are combined in a non-linear ratio <NUM>. The inter-arrival rate represents the rate of arrival of data packets associated with the corresponding flow.

Using packet length <NUM> and packet bit rate <NUM>, the packet switch <NUM> generates a ratio <NUM> to calculate packet durations <NUM>. The packet switch <NUM> computes <NUM> the maximum packet duration to generate a nonlinear ratio <NUM> of the packet durations <NUM> relative to the largest packet duration.

The results of the inter-arrival times nonlinear ratio <NUM> and the packet duration nonlinear ratio <NUM> are combined and used to compute <NUM> one or more histograms. The packet switch <NUM> applies a detection criterion (e.g., threshold) <NUM> to the histogram to reduce and/or overcome jitter or noise. In computer networks, such as network <NUM>, there can be a lot of jitter based on the number of repeater links that each packet goes through, with more links adding more jitter. By applying the detection threshold <NUM> to the histogram, anything above the detection threshold <NUM> is kept as actual data packets, while anything below the detection threshold <NUM> is discarded as jitter. The detection threshold <NUM> can be calculated by the packet switch <NUM>. The detection threshold <NUM> can also be pre-computed and based on the network configuration <NUM>, and provided in a security policy.

Next the packet switch <NUM> performs several steps to properly apply histogram generated data for PSD analysis. These steps include, but are not limited to, determining the ratio <NUM> of the max number of data packets over the histogram packets, determining relative packet gain <NUM>, and determining nonlinear sorted weighing and rounding <NUM>. The goal is to maintain a positive signal to noise ratio for low duration and bursty packets.

Then, the packet switch <NUM> uses half of the minimum <NUM> of the packet duration as sample time to generate <NUM> a sampled rectangular sequence, which represents the enhanced data packets as a rectangular sequence of data packets where the duration is representative of the actual data packets and the amplitude is representative of the energy assigned to the data packets.

The packet switch <NUM> analyzes the power spectral density data to show at what frequencies various packet sequences are occurring. In the example, the power spectral density estimate <NUM> is calculated using the Welch periodogram. The packet switch <NUM> combines the power spectral density estimate <NUM> with the data packets that exceeded the detection threshold <NUM> with the histogram <NUM> to determine <NUM> the detected packet types (flows). The histogram data includes the number of data packets in each flow. The security policy includes expected flows. The packet switch <NUM> compares the expected flows to the detected flows to detect any unexpected flows. In one example, the packet switch <NUM> removes the expected flows from the detected flows in the histogram <NUM> to determine if there are any unexpected flows remaining in the altered histogram.

Since the topology of the network <NUM> is known, anything beyond that is unexpected and therefore anomalous and potentially malicious. When unexpected data is detected, the packet switch <NUM> transmits a notification that there are unexpected flows. The packet switch <NUM> can also provide the frequency, arrival times, durations, and/or number of anomalous data packets. The anomalous data packets could indicate a malicious threat, or a misconfiguration of the security policy that the packet switch <NUM> was using for analysis. The packet switch <NUM> can notify an operations center, a security center, or take an action. Actions could include, but are not limited to, providing additional notifications, alerts, triggering another program, changing the topology of the network, and/or blocking traffic.

<FIG> illustrate the results of an analysis of different example flows using the algorithm <NUM> (shown in <FIG> and performed by packet switch <NUM>). Table <NUM> below shows the different flows that could be contained in each analysis. For the purposes of this analysis, Flow <NUM> is the only expected flow. Flow <NUM> provides <NUM>,<NUM> data packets of 1500B at <NUM> with a flow data rate of <NUM> Mbps.

<FIG> illustrates a first graph <NUM> of a first analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> illustrates a power spectral density plot of Flow <NUM>. Graph <NUM> includes the frequency of the packet arrivals for the various packet types on the x-axis in kilohertz (kHz) and the power spectral density (PSD) in decibels (dB) on the y-axis. In the center of graph <NUM>, Flow <NUM> is shown at <NUM>. The other components shown in graph <NUM> are inter-arrival jitter, which are less than -<NUM> dB.

<FIG> illustrates a first histogram <NUM> of the first analysis of traffic flows shown in <FIG>. For the purposes of algorithm <NUM> (shown in <FIG>) the dominant flow is excluded from the histogram <NUM>. This allows the packet switch <NUM> (or a co-located processor) to identify the additional flows shown in the histogram <NUM>. The histograms <NUM> include the relative weight in dB on the x-axis and the number of packets on the y-axis. By excluding the dominant flow, the histogram <NUM> can display the information about the other detected flows without being overshadowed by the dominant flow. For the purposes of this discussion, the dominant flow (Flow <NUM>) is the expected flow and all other flows are unexpected and potentially malicious. The packet switch <NUM> removes all of the expected flows from the histogram <NUM> to concentrate on the unexpected flows. In the ideal state, the histogram <NUM> is blank because there are no unexpected flows.

<FIG> illustrates a second graph <NUM> of a second analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> shows the dominant flow (Flow <NUM>) at <NUM> and a second flow repeating every <NUM>. This second flow is Flow <NUM> from Table <NUM>. <FIG> illustrates a second histogram <NUM> of the second analysis of traffic flows shown in <FIG>. The histogram <NUM> shows Flow <NUM> with <NUM> packets. The dominant flow (Flow <NUM>) is excluded from the histogram <NUM>. Therefore, the second flow is <NUM> packets per second for a total of <NUM> packets.

<FIG> illustrates a third graph <NUM> of a third analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> shows the dominant flow (Flow <NUM>) at <NUM>, a second flow repeating every <NUM> (Flow <NUM>), and a third flow repeating every <NUM> (Flow <NUM>). <FIG> illustrates a third histogram <NUM> of the third analysis of traffic flows shown in <FIG>. Histogram <NUM> shows ~<NUM> packets at <NUM> dB, <NUM> packet at <NUM> dB, ~<NUM> packets at <NUM> dB, and ~<NUM> packets at <NUM> dB. For the purposes of analysis, the sets of packets within <NUM> dB of each other are considered to be a part of the same flow, but have been affected by jitter. Therefore, the <NUM> packet at <NUM> dB is a part of the packets at <NUM> dB, and the <NUM> packets at -<NUM> dB are part of the packets at <NUM> dB. As seen in <FIG> and <FIG>, the detection threshold <NUM> removed the majority of the jitter, but some still remains. However, for analysis purposes, this is acceptable because the dominant flow is clearly visible on graph <NUM>. Accordingly, the second flow is providing <NUM> packets at <NUM> packets per second and the third flow is providing <NUM> packets at <NUM> packets per second.

While Flows <NUM>, <NUM>, and <NUM> all have packets of <NUM> bytes, algorithm <NUM> can detect packets of different byte sizes. In <FIG> and <FIG> the packets in the dominant flow (Flow <NUM>) remain at a size of <NUM> bytes, while the packets for the second flow (Flow <NUM>) are only <NUM> bytes long. Furthermore, the algorithm <NUM> detects the different flows at their different flow data rates. Flow <NUM> has a flow data of <NUM> Mbps, while Flow <NUM> has a flow data rate of <NUM> Kbps. <FIG> illustrates a fourth graph <NUM> of a fourth analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> shows the dominant flow at <NUM> (Flow <NUM>) and a second flow repeatedly at <NUM> (Flow <NUM>). <FIG> illustrates a fourth histogram <NUM> of the fourth analysis of traffic flows shown in <FIG>. Histogram <NUM> illustrates <NUM> packets at <NUM> dB and <NUM> packets at <NUM> dB. Accordingly, the second flow is providing <NUM> packets at <NUM> packets per second.

<FIG> illustrates a fifth graph <NUM> of a fifth analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> shows the dominant flow at <NUM> (Flow <NUM>), a second flow repeating at <NUM> (Flow <NUM>), and a third flow repeating at <NUM> (Flow <NUM>). <FIG> illustrates a fifth histogram <NUM> of the fifth analysis of traffic flows shown in <FIG>. Histogram <NUM> illustrates <NUM> packets at <NUM> dB and <NUM> packets at <NUM> dB. Accordingly, the second flow is providing <NUM> packets at <NUM> packets per second and the third flow is providing <NUM> packets at <NUM> packets per second.

<FIG> illustrates a sixth graph <NUM> of a sixth analysis of traffic flows using the algorithm <NUM> (shown in <FIG>). Graph <NUM> shows the dominant flow at <NUM> (Flow <NUM>) and a second flow repeatedly at <NUM> (Flow <NUM>). <FIG> illustrates a sixth histogram <NUM> of the sixth analysis of traffic flows shown in <FIG>. Histogram <NUM> illustrates <NUM> packets at <NUM> dB and <NUM> packets at <NUM> dB. Accordingly, the second flow is providing <NUM> packets at <NUM> packets per second.

<FIG> illustrates a simplified block diagram of an example communication network analyzer ("CNA") system <NUM> for analyzing communication traffic on the network <NUM> (shown in <FIG>). In the example, CNA system <NUM> is used for controlling the operation of an algorithm for monitoring the communications of satellites <NUM> (shown in <FIG>) and other devices on the network <NUM>. The algorithm monitors the communications on the network <NUM> for malicious data flows that may indicate cybersecurity threats and attacks to allow other systems to potential respond to the identified detected cybersecurity threats and attacks.

The CNA system <NUM> includes a CNA computer device <NUM> in communication with one or more communication ports <NUM>. The CNA computer device <NUM> can be similar to packet switch <NUM> or other processing unit executing on a satellite <NUM> (both shown in <FIG>) or user device <NUM> (shown in <FIG>) in network <NUM>. In some examples, packet switch <NUM> is co-located with one or more additional processors that can perform one or more steps of algorithm <NUM> (shown in <FIG>). The communication ports <NUM> can be similar to port <NUM> (shown in <FIG>). The one or more communication ports <NUM> are each in communication with a communication device <NUM>. The communication devices <NUM> can be similar to satellite <NUM> and/or user device <NUM>. In an example, the CNA computer device is also in communication with a network controller <NUM> which provides security policies to the CNA computer device <NUM>. The CNA computer device <NUM> can also be in communication with a database server <NUM> for retrieving and storing data in a database <NUM>.

The CNA computer device <NUM> is programmed to receive signature information and/or security policies about different configurations of the computer network <NUM>. The security policies can include information about the network topology so that the algorithm analyzing the traffic flows can recognize expected data flows and detect unexpected data flows when they are present. In some examples, the security policies include a signature of expected traffic flows for the current configuration of the network. The security policies can include information, such as, but not limited to, when a user is supposed to connect, how long they will connect, the MOD/COD of the connection <NUM>, the data rate of the connection <NUM>, the demand over the connection <NUM> will be for a defined number of data flows, information about those data flows, such as packet sizes, how the application is transmitting those data packets, arrival times, protocols (if available) and the like. All of that information is compiled on a per connection <NUM> basis. The security policies can be based on network information such as, but is not limited to, the knowledge of the satellites <NUM> (shown in <FIG>) in the network <NUM> at a specific point in time or during a defined interval of time, including where the satellites <NUM> are located, which device <NUM> and <NUM> is connected to, and which device <NUM> and <NUM> should be connected to at each specific point in time or during specified intervals of time, and/or the duration of each connection <NUM>. The network information can also include, but is not limited to, how the user devices <NUM> are connected to the network <NUM> and the satellites <NUM>, the types of connections <NUM> between the satellites <NUM> themselves and between the satellites <NUM> and the user devices <NUM>, the MOD/COD (modulation and coding, where coding refers to FEC (forward error correction) overhead), the data rates, and the traffic profiles (what kind of traffic are users expected to generate) along the network <NUM> for each network configuration <NUM> and <NUM> (shown in <FIG> and <FIG>, respectively). In some examples, the CNA computer device <NUM> receives the security policy from the network controller <NUM>. In other examples, the CNA computer device <NUM> stores a plurality of security policies and uses different security policies at different points in time based on the configuration of the network <NUM>. In some examples, all of the connections <NUM> and <NUM> (both shown in <FIG>) are known in advance. In some of these examples, the algorithm control <NUM> transmits a signal indicating when to use each security policy. In other of these examples, the network controller <NUM> transmits a schedule, which informs the CNA computer device <NUM> when to use which security policy. In some examples, the CNA computer device <NUM> stores a plurality of different algorithms. In some of these examples, the network controller <NUM> informs the CNA computer device <NUM> which algorithm to use when and with which security policy.

In other examples, one or more user devices <NUM> may be able to connect to the network <NUM> on an ad-hoc basis. In these examples, the new user device <NUM> negotiates a connection <NUM> to the network <NUM>. The new user device's information is passed to the network controller <NUM> or the CNA computer device <NUM>, which generates a new security policy for the new user device <NUM> and for the devices <NUM> and <NUM> that have connections <NUM> to the new user device <NUM>.

The CNA computer device <NUM> uses a security policy for communication port <NUM> with a connection <NUM> to a communication device <NUM>. In the example, the CNA computer device <NUM> executes an algorithm for monitoring each connection <NUM>, where the algorithms are configured to use the security policies to monitor the communication ports <NUM> associated with one or more connections <NUM> for malicious traffic flows. The CNA computer device <NUM> activates the appropriate algorithms and the appropriate security policies when the network <NUM> is in the corresponding configuration.

For example, based on network configurations <NUM> and <NUM>, the CNA computer device <NUM> determines that the first network configuration <NUM> will be valid from Time A to Time B and the second network configuration <NUM> will be valid from Time B to Time C. Furthermore, the CNA computer device <NUM> knows the security policy for each network configuration <NUM> and <NUM>. This security policy can be stored in database <NUM> or received from network controller <NUM>.

For each network configuration <NUM> and <NUM>, the CNA computer device <NUM> determines which algorithm and security policy to use monitoring each connection <NUM>. For example, in the first network configuration <NUM>, the CNA computer device <NUM> associated with satellite #<NUM> determines which security policy to run with the algorithm, (such as algorithm <NUM> shown in <FIG>) to run on satellite #<NUM> for the ISL connection <NUM> to satellite #<NUM>. The CNA computer device <NUM> can use a different security policy to use in monitoring the ISL connection <NUM> to satellite #<NUM>. Furthermore, the CNA computer device <NUM> can simultaneously execute multiple copies of the algorithm, one for each communication port <NUM> with an active connection <NUM>. The different copies of the algorithm can each be using different security policies based on their connection and the configuration of the network <NUM>. The CNA computer device <NUM> associated with satellite #<NUM> determines which algorithm to run on satellite #<NUM> for the ISL connection <NUM> and determines which security policy to use for satellite #<NUM>'s algorithm to monitor the ISL connection <NUM>. The algorithms and security policies executing on each satellite <NUM> can be different on different satellites <NUM> or even different ports <NUM> of the same satellite <NUM>. The CNA computer device <NUM> and/or network controller <NUM> selects the algorithms and security policies based on one or more attributes of the satellites in question and/or the configuration of the network <NUM>.

The CNA computer devices <NUM> ensure that the appropriate algorithms and security policies are activated on the corresponding satellites <NUM> at the correct time. In some examples, the CNA computer device <NUM> receives the security policies and algorithms from the network controller <NUM> in advance, along with a schedule that instructs the CNA computer device <NUM> when to activate each algorithm and security policy. For example, the CNA computer device <NUM> can receive the algorithms and security policies for the first network configuration <NUM> and the second network configuration <NUM>. When Time A begins, then the CNA computer device <NUM> associated each satellite <NUM> activates the predetermined algorithm and security policies associated with the first network configuration <NUM>. When Time B is reached, then the CNA computer device <NUM> associated with each satellite <NUM> activates the predetermined algorithm and security policies associated with the second network configuration <NUM>, and so forth. In these examples, the network controller <NUM> can transmit the algorithms and security policies to the CNA computer devices <NUM> well in advance of the beginning of the corresponding network configurations. Furthermore, in some examples, a network configuration can be repeated at multiple points in time. In these examples, each CNA computer devices <NUM> can store a plurality of algorithms and security policies and the CNA computer device <NUM> can receive a signal from the network controller <NUM> including which algorithm and security policy to activate at different points in time. In other examples, the network controller <NUM> transmits one or more of the appropriate algorithms and the security policies to the CNA computer device <NUM> at the beginning of a new network configuration. While the above is stated with respect satellites <NUM>, any communication device can be used with the systems and methods describe herein. In some examples, instead of a schedule, each of the security policies includes an active time attribute, and the CDNA computer device <NUM> activates that security policy at the appropriate time.

In the example, CNA computer devices <NUM> are systems, such as the packet switch <NUM> (shown in <FIG>) that can execute algorithms and security policies to monitor communications <NUM> on ports <NUM> (both shown in <FIG>). In other examples, the CNA computer device <NUM> could also be, but are not limited to, a network card, repeater hub, network bridge, switching hub, bridging hub, MAC bridge, or any other device configured to transmit and receive messages, such as data packets. In the example, the CNA computer device <NUM> is in communication with the network controller <NUM> to receive signals about which algorithms and security policies to use when. In the example, the network controller <NUM> can communicate with the CNA computer devices <NUM> over ISL connections <NUM> and DL connections <NUM>. The CNA computer device <NUM> can also provide information to the network controller <NUM>, user devices <NUM> (shown in <FIG>), or other communication devices <NUM> about detected potential malicious data flows or other deviations from the security policies. In other examples, algorithm <NUM> could be executed in a centralized location, where a computer device at the centralized location monitors communications (i.e., data flows) in the network <NUM> and reviews those communications in view of the appropriate security policies. CNA computer devices <NUM> can be a part of satellites <NUM> or user devices <NUM>, where connections <NUM> over ports <NUM> are available to be monitored.

In the example, communication devices <NUM> are computers that include a web browser or a software application, which enables client communication devices <NUM> to communicate with the CNA computer device <NUM> using the Internet, a local area network (LAN), or a wide area network (WAN). In some examples, the communication devices <NUM> are communicatively coupled to the Internet through many interfaces including, but not limited to, at least one of a network, such as the Internet, a LAN, a WAN, or an integrated services digital network (ISDN), a dial-up-connection, a digital subscriber line (DSL), a cellular phone connection, a satellite connection, and a cable modem. Communication devices <NUM> can be any device capable of accessing a network, such as the Internet, including, but not limited to, a desktop computer, a laptop computer, a personal digital assistant (PDA), a cellular phone, a smartphone, a tablet, a phablet, or other web-based connectable equipment. In at least one example, one or more communication devices <NUM> include a web browser that can be used to output information to the network controller <NUM> or the CNA computer device <NUM>, such as to provide context information about one or more configurations of the network <NUM> or one or more warnings about malicious data flows. In some examples, the communication devices <NUM> monitor or control the path of a satellite <NUM> and provide information about the satellite <NUM>. In other examples, the communication devices <NUM> facilitate communication between the CNA computer devices <NUM> and the network controller <NUM>.

The application includes information about the satellites <NUM> and the user devices <NUM> in the network <NUM> and is able to determine which algorithms and which security policies to use at specific points in time or specific network configurations to monitor the data flows of the computer network <NUM>. The application can be provided as a cloud-based web-service over the Internet or other network. In some examples, the network controller <NUM> includes at least one application executing on the network controller <NUM> to perform the network analysis.

A database server <NUM> is communicatively coupled to a database <NUM> that stores data. In one example, the database <NUM> includes a plurality of satellite communication attributes, a plurality of attributes of algorithms, a plurality of security policy information, and additional information about user devices <NUM>. In some examples, the database <NUM> is stored remotely from the CNA computer device <NUM>. In some examples, the database <NUM> is decentralized. In the example, a person can access the database <NUM> via a user device <NUM> by logging onto at least one of a CNA computer device <NUM> and a network controller <NUM>.

At a high level, the algorithm is executing on an FPGA or other processor that is a part of the CNA computer device <NUM>. The algorithm generates data, such as statistical data in the form of logs. The algorithm can be collocated on a satellite <NUM>, user device <NUM>, or communication device <NUM> and also running on a computer device, such as a network controller <NUM>. The computer device then interprets the logs. Based on the review of the algorithm's logs something can be detected. Based on detection, the network controller <NUM>, the CNA computer device <NUM>, or other client device can notify an operations center, a security center, or take an action. Actions could include, but are not limited to, providing notifications, alerts, triggering another program, changing the topology of the network, or blocking traffic.

<FIG> illustrates an example process <NUM> for analyzing communication traffic on the network <NUM> (shown in <FIG>) and using the system <NUM> (shown in <FIG>). The steps of process <NUM> can be performed by the packet switch <NUM> of a satellite <NUM> both shown in <FIG>) or other device <NUM> (shown in <FIG>) and/or the CNA computer device <NUM> (shown in <FIG>). In at least one example, the packet switch <NUM> executing process <NUM> is on a satellite <NUM>. In one example, the packet switch <NUM> executes process <NUM> for each port <NUM> (shown in <FIG>) that is in communication <NUM> (shown in <FIG>) with another communication device <NUM> (shown in <FIG>).

In some examples, the packet switch <NUM> executes a different instantiation of process <NUM> for each active port <NUM>. In other examples, packet switch <NUM> executes one instantiation of process <NUM> that monitors multiple ports <NUM>.

The CNA computer device <NUM> or packet switch <NUM> is in communication with one or more of the devices in the network <NUM>. The devices in the network can include, but are not limited to, satellites <NUM>, user devices <NUM>, communication devices <NUM>, and network controllers <NUM> (shown in <FIG>).

The CNA computer device <NUM> receives <NUM> packet information for a plurality of data packets transmitted over the network <NUM> (shown in <FIG>). The packet information includes, but is not limited to, packet arrival times <NUM>, packet length <NUM>, and packet bit rate <NUM> (all shown in <FIG>). The CNA computer device <NUM> monitors the data packets being transmitted over or received through one or more ports <NUM> in real-time. The CNA computer device <NUM> determines the packet information based on reviewing the plurality of data packets being transmitted by the computer system <NUM> or <NUM> through the ports <NUM>.

The CNA computer device <NUM> calculates <NUM> inter-arrival times <NUM> (shown in <FIG>) for the plurality of data packets based on the packet information. The CNA computer device <NUM> adjusts the plurality of inter-arrival times for the plurality of data packets to remove gaps <NUM> (shown in <FIG>). The CNA computer device <NUM> computes inter-arrival rate <NUM> (shown in <FIG>) for the plurality of data packets based on the packet information. The CNA computer device <NUM> computes median (or mean) inter-arrival rate <NUM> (shown in <FIG>) for the plurality of data packets. Then the CNA computer device <NUM> adjusts the plurality of inter-arrival times to remove one or more gaps <NUM> based on the median inter-arrival rate <NUM>.

The CNA computer device <NUM> calculates <NUM> packet durations <NUM> (shown in <FIG>) for the plurality of data packets based on the packet information. The CNA computer device <NUM> filters <NUM> the packet information to remove noise and jitter. The CNA computer device <NUM> applies a detection threshold <NUM> (shown in <FIG>) to the plurality of data packets to filter the packet information to remove noise. The CNA computer device <NUM> generates <NUM> at least one histogram <NUM> (shown in <FIG>) based on the packet information, the inter-arrival times <NUM>, and the packet durations <NUM>. The CNA computer device <NUM> also generates <NUM> a power spectral density estimate <NUM> (shown in <FIG>) based on the packet information, the inter-arrival times <NUM>, and the packet durations <NUM>.

The CNA computer device <NUM> analyzes <NUM> the at least one histogram <NUM> and the power spectral density estimate <NUM> to detect one or more unexpected data flows. The CNA computer device <NUM> detects one or more data flows <NUM> (shown in <FIG>) in the at least one histogram <NUM> and the power spectral density estimate <NUM>. The CNA computer device <NUM> compares the one or more detected data flows to one or more expected data flows. The CNA computer device <NUM> detects the one or more unexpected data flows based on the comparison. In one example, the CNA computer device <NUM> filters the one or more expected data flows from the at least one histogram <NUM> and analyzes the at least one filtered histogram <NUM> to detect one or more unexpected data flows.

Based on detection of one or more unexpected data flows, the CNA computer device <NUM> reports the one or more unexpected data flows. The CNA computer device <NUM> can transmit the notification to the network controller <NUM>. In addition, the network controller <NUM>, the CNA computer device <NUM>, or other client device can notify an operations center, a security center, or take an action. Actions could include, but are not limited to, providing notifications, alerts, triggering another program, changing the topology of the network, or blocking traffic.

The CNA computer device <NUM> can receive a security policy including the one or more expected data flows and store the security policy. The CNA computer device <NUM> can also store a plurality of security policies. Each security policy of the plurality of security policies is associated with a configuration <NUM> or <NUM> (both shown in <FIG>) of the network <NUM>. The CNA computer device <NUM> activates a security policy associated with a current configuration <NUM> of the network <NUM>.

In some examples where the CNA computer device <NUM> stores one or more security policies, the CNA computer device <NUM> receives a security policy from the network controller <NUM> (shown in <FIG>) to activate at that point in time. In other examples where the CNA computer device <NUM> stores one or more security policies, the CNA computer device <NUM> receives a signal from the network controller <NUM> instructing the CNA computer device <NUM> to activate on of the stored security policies. In further examples where the CNA computer device <NUM> stores one or more security policies, the CNA computer device <NUM> can also receive a schedule from the network controller <NUM>. The schedule comprises the active times of when each algorithm and security policy is to be activated. The CNA computer device <NUM> activates the corresponding algorithm and security policy based on the script. For example, the script can include all of the algorithms and security policies to be used during a day, hour, or other period of time for the network <NUM>. The security policies can include information about the expected data flows.

<FIG> illustrates an example configuration of a user computer device <NUM> used in the CNA system <NUM> (shown in <FIG>), in accordance with one example of the present disclosure. User computer device <NUM> is operated by a user <NUM>. The user computer device <NUM> can include, but is not limited to, satellites <NUM>, packet switches <NUM> (both shown in <FIG>), user devices <NUM> (shown in <FIG>), the communication device <NUM>, and the network controller <NUM> (both shown in <FIG>). The user computer device <NUM> includes a processor <NUM> for executing instructions. In some examples, executable instructions are stored in a memory area <NUM>. The processor <NUM> can include one or more processing units (e.g., in a multi-core configuration). The memory area <NUM> is any device allowing information such as executable instructions and/or transaction data to be stored and retrieved. The memory area <NUM> can include one or more computer-readable media.

The user computer device <NUM> also includes at least one media output component <NUM> for presenting information to the user <NUM>. The media output component <NUM> is any component capable of conveying information to the user <NUM>. In some examples, the media output component <NUM> includes an output adapter (not shown) such as a video adapter and/or an audio adapter. An output adapter is operatively coupled to the processor <NUM> and operatively coupleable to an output device such as a display device (e.g., a cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED) display, or "electronic ink" display) or an audio output device (e.g., a speaker or headphones). In some examples, the media output component <NUM> is configured to present a graphical user interface (e.g., a web browser and/or a client application) to the user <NUM>. A graphical user interface can include, for example, an interface for viewing the monitoring data about a network <NUM> (shown in <FIG>). In some examples, the user computer device <NUM> includes an input device <NUM> for receiving input from the user <NUM>. The user <NUM> can use the input device <NUM> to, without limitation, input network configuration information. The input device <NUM> can include, for example, a keyboard, a pointing device, a mouse, a stylus, a touch sensitive panel (e.g., a touch pad or a touch screen), a gyroscope, an accelerometer, a position detector, a biometric input device, and/or an audio input device. A single component such as a touch screen can function as both an output device of the media output component <NUM> and the input device <NUM>.

The user computer device <NUM> can also include a communication interface <NUM>, communicatively coupled to a remote device such as the CNA computer device <NUM> (shown in <FIG>). The communication interface <NUM> can include, for example, a wired or wireless network adapter and/or a wireless data transceiver for use with a mobile telecommunications network.

Stored in the memory area <NUM> are, for example, computer-readable instructions for providing a user interface to the user <NUM> via the media output component <NUM> and, optionally, receiving and processing input from the input device <NUM>. A user interface can include, among other possibilities, a web browser and/or a client application. Web browsers enable users, such as the user <NUM>, to display and interact with media and other information typically embedded on a web page or a website from the CNA computer device <NUM>. A client application allows the user <NUM> to interact with, for example, the CNA computer device <NUM>. For example, instructions can be stored by a cloud service, and the output of the execution of the instructions sent to the media output component <NUM>.

The processor <NUM> executes computer-executable instructions for implementing aspects of the disclosure.

<FIG> illustrates an example configuration of a server computer device <NUM> used in the CNA system <NUM> (shown in <FIG>), in accordance with one example of the present disclosure. Server computer device <NUM> can include, but is not limited to, the CNA computer device <NUM>, the database server <NUM>, and the network controller <NUM> (all shown in <FIG>). The server computer device <NUM> also includes a processor <NUM> for executing instructions. Instructions can be stored in a memory area <NUM>. The processor <NUM> can include one or more processing units (e.g., in a multi-core configuration).

The processor <NUM> is operatively coupled to a communication interface <NUM> such that the server computer device <NUM> is capable of communicating with a remote device such as another server computer device <NUM>, a CNA computer device <NUM>, another network controller <NUM>, or the communication device <NUM> (shown in <FIG>). For example, the communication interface <NUM> can receive requests from the network controller <NUM> via the Internet, as illustrated in <FIG>.

The processor <NUM> can also be operatively coupled to a storage device <NUM>. The storage device <NUM> is any computer-operated hardware suitable for storing and/or retrieving data, such as, but not limited to, data associated with the database <NUM> (shown in <FIG>). In some examples, the storage device <NUM> is integrated in the server computer device <NUM>. For example, the server computer device <NUM> can include one or more hard disk drives as the storage device <NUM>. In other examples, the storage device <NUM> is external to the server computer device <NUM> and can be accessed by a plurality of server computer devices <NUM>. For example, the storage device <NUM> can include a storage area network (SAN), a network attached storage (NAS) system, and/or multiple storage units such as hard disks and/or solid state disks in a redundant array of inexpensive disks (RAID) configuration.

In some examples, the processor <NUM> is operatively coupled to the storage device <NUM> via a storage interface <NUM>. The storage interface <NUM> is any component capable of providing the processor <NUM> with access to the storage device <NUM>. The storage interface <NUM> can include, for example, an Advanced Technology Attachment (ATA) adapter, a Serial ATA (SATA) adapter, a Small Computer System Interface (SCSI) adapter, a RAID controller, a SAN adapter, a network adapter, and/or any component providing the processor <NUM> with access to the storage device <NUM>.

The processor <NUM> executes computer-executable instructions for implementing aspects of the disclosure. In some examples, the processor <NUM> is transformed into a special purpose microprocessor by executing computer-executable instructions or by otherwise being programmed. For example, the processor <NUM> is programmed with instructions such as those shown in <FIG>.

As used herein, a processor can include any programmable system including systems using micro-controllers; reduced instruction set circuits (RISC), application-specific integrated circuits (ASICs), logic circuits, and any other circuit or processor capable of executing the functions described herein. The above examples are example only, and are thus not intended to limit in any way the definition and/or meaning of the term "processor.

As used herein, the term "cybersecurity threat" includes an unauthorized attempt to gain access to a subject system. Cybersecurity threats, also known as cyber-attacks or cyber-threats, attempt to breach computer systems by taking advantage of vulnerabilities in the computer systems. Some cybersecurity threats include attempts to damage or disrupt a subject system. These cybersecurity threats can include, but are not limited to, active intrusions, spyware, malware, viruses, and worms. Cybersecurity threats may take many paths (also known as attack paths) to breach a system. These paths may include operating system attacks, misconfiguration attacks, application level attacks, and shrink wrap code attacks. Cybersecurity threats may be introduced by individuals or systems directly accessing a computing device, remotely via a communications network or connected system, or through an associated supply chain.

As used herein, the term "database" can refer to either a body of data, a relational database management system (RDBMS), or to both. As used herein, a database can include any collection of data including hierarchical databases, relational databases, flat file databases, object-relational databases, object-oriented databases, and any other structured collection of records or data that is stored in a computer system. The above examples are example only, and thus are not intended to limit in any way the definition and/or meaning of the term database. Examples of RDBMS' include, but are not limited to including, Oracle® Database, MySQL, IBM® DB2, Microsoft® SQL Server, Sybase®, and PostgreSQL. However, any database can be used that enables the systems and methods described herein. (Oracle is a registered trademark of Oracle Corporation, Redwood Shores, California; IBM is a registered trademark of International Business Machines Corporation, Armonk, New York; Microsoft is a registered trademark of Microsoft Corporation, Redmond, Washington; and Sybase is a registered trademark of Sybase, Dublin, California.

In another example, a computer program is provided, and the program is embodied on a computer-readable medium. In an example, the system is executed on a single computer system, without requiring a connection to a server computer. In a further example, the system is being run in a Windows® environment (Windows is a registered trademark of Microsoft Corporation, Redmond, Washington). In yet another example, the system is run on a mainframe environment and a UNIX® server environment (UNIX is a registered trademark of X/Open Company Limited located in Reading, Berkshire, United Kingdom). In a further example, the system is run on an iOS® environment (iOS is a registered trademark of Cisco Systems, Inc. located in San Jose, CA). In yet a further example, the system is run on a Mac OS® environment (Mac OS is a registered trademark of Apple Inc. located in Cupertino, CA). In still yet a further example, the system is run on Android® OS (Android is a registered trademark of Google, Inc. of Mountain View, CA). In another example, the system is run on Linux® OS (Linux is a registered trademark of Linus Torvalds of Boston, MA). The application is flexible and designed to run in various different environments without compromising any major functionality.

Furthermore, references to "example" or "one example" of the present disclosure are not intended to be interpreted as excluding the existence of additional examples that also incorporate the recited features. Further, to the extent that terms "includes," "including," "has," "contains," and variants thereof are used herein, such terms are intended to be inclusive in a manner similar to the term "comprises" as an open transition word without precluding any additional or other elements.

As used herein, the terms "software" and "firmware" are interchangeable, and include any computer program stored in memory for execution by a processor, including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory. The above memory types are example only, and are thus not limiting as to the types of memory usable for storage of a computer program.

Furthermore, as used herein, the term "real-time" refers to at least one of the time of occurrence of the associated events, the time of measurement and collection of predetermined data, the time to process the data, and the time of a system response to the events and the environment. In the examples described herein, these activities and events occur substantially instantaneously.

The methods and system described herein can be implemented using computer programming or engineering techniques including computer software, firmware, hardware, or any combination or subset. As disclosed above, at least one technical problem with prior systems is that there is a need for systems for monitoring communication networks, where the networks can change over time. The system and methods described herein address that technical problem. Additionally, at least one of the technical solutions to the technical problems provided by this system can include: (i) monitoring message traffic data in real-time; (ii) monitoring encrypted message traffic; (iii) improved detection of infrequent or small packet data flows amongst other traffic; (iv) allowing for message traffic monitoring without requiring extensive infrastructure updates; (v) monitoring message traffic data for changing networks; and (vi) requiring less packet data to allow for monitoring message traffic data.

The methods and systems described herein can be implemented using computer programming or engineering techniques including computer software, firmware, hardware, or any combination or subset thereof, wherein the technical effects can be achieved by performing at least one of the following steps: a) based on packet information received for a plurality of data packets transmitted over the network, calculate inter-arrival times and packet durations for the plurality of data packets, wherein the packet information includes arrival times associated with the plurality of data packets, a length of the plurality of data packets, and a bit rate of the plurality of data packets, wherein the computer system is associated with a packet switch; b) filter the packet information to remove noise; c) generate at least one histogram based on the packet information, the inter-arrival times, and the packet durations; d) generate a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations; e) analyze the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows; f) report the one or more unexpected data flows; g) determine the packet information based on reviewing the plurality of data packets being transmitted by the computer system; h) adjust the inter-arrival times for the plurality of data packets to remove one or more gaps; i) compute inter-arrival rate for the plurality of data packets based on the packet information; j) compute median inter-arrival rate for the plurality of data packets; k) adjust the inter-arrival times to remove the one or more gaps based on the median inter-arrival rate; <NUM>) apply a detection criterion to the histogram results of the plurality of data packets to filter the packet information to remove the noise; m) detect one or more data flows in the at least one histogram and the power spectral density estimate; n) compare the one or more detected data flows to one or more expected data flows; o) detect the one or more unexpected data flows based on the comparison; p) filter the one or more expected data flows from the at least one histogram; o) analyze the at least one filtered histogram to detect the one or more unexpected data flows; p) receive a security policy including the one or more expected data flows; q) store the security policy; r) store a plurality of security policies, wherein each security policy of the plurality of security policies is associated with a configuration of the network; and s) activate a security policy associated with a current configuration of the network.

In some examples, the technical effects can be achieved by performing at least one of the following steps: a) receiving, by the processor, packet information for a plurality of data packets transmitted over the network; b) calculating, by the processor, inter-arrival times for the plurality of data packets based on the packet information; c) calculating, by the processor, packet durations for the plurality of data packets based on the packet information; d) filtering, by the processor, the packet information to remove noise; e) generating, by the processor, at least one histogram based on the packet information, the inter-arrival times, and the packet durations; f) generating, by the processor, power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations; g) analyzing, by the processor, the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows; h) reporting, by the processor, the one or more unexpected data flows; i) determining the packet information based on reviewing the plurality of data packets being transmitted by the computer system; j) adjusting the inter-arrival times for the plurality of data packets to remove one or more gaps; k) computing inter-arrival rate for the plurality of data packets based on the packet information; l) computing median inter-arrival rate for the plurality of data packets; m) adjusting of inter-arrival times to remove gaps based on the median inter-arrival rate; n) applying a detection threshold to the histogram results of the plurality of data packets to filter the packet information to remove the noise; o) detecting one or more data flows in the at least one histogram and the power spectral density estimate; p) comparing the one or more detected data flows to one or more expected data flows; q) filtering the one or more expected data flows from the at least one histogram; and r) analyzing the at least one filtered histogram to detect the one or more unexpected data flows.

In some examples, the technical effects can be achieved by performing at least one of the following steps: a) receive a security policy to execute on the system, wherein the security policy includes configuration data; b) receive packet information for a plurality of data packets transmitted over the network; c) calculate inter-arrival times for the plurality of data packets based on the packet information and the security policy; d) calculate, by the processor, packet durations for the plurality of data packets based on the packet information; e) filter the packet information to remove noise based on the security policy; f) generate at least one histogram based on the packet information, the inter-arrival times, and the packet durations; h) generate a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations; i) analyze the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows based on the security policy; j) report the one or more unexpected data flows; and k) adjust the inter-arrival times for the plurality of data packets to remove one or more gaps based on the security policy.

The computer-implemented methods discussed herein can include additional, less, or alternate actions, including those discussed elsewhere herein. The methods can be implemented via one or more local or remote processors, transceivers, servers, and/or sensors (such as processors, transceivers, servers, and/or sensors mounted on vehicles or mobile devices, or associated with smart infrastructure or remote servers), and/or via computer-executable instructions stored on non-transitory computer-readable media or medium. Additionally, the computer systems discussed herein can include additional, less, or alternate functionality, including that discussed elsewhere herein. The computer systems discussed herein can include or be implemented via computer-executable instructions stored on non-transitory computer-readable media or medium.

As used herein, the term "non-transitory computer-readable media" is intended to be representative of any tangible computer-based device implemented in any method or technology for short-term and long-term storage of information, such as, computer-readable instructions, data structures, program modules and sub-modules, or other data in any device. Therefore, the methods described herein can be encoded as executable instructions embodied in a tangible, non-transitory, computer readable medium, including, without limitation, a storage device and/or a memory device. Such instructions, when executed by a processor, cause the processor to perform at least a portion of the methods described herein. Moreover, as used herein, the term "non-transitory computer-readable media" includes all tangible, computer-readable media, including, without limitation, non-transitory computer storage devices, including, without limitation, volatile and nonvolatile media, and removable and non-removable media such as a firmware, physical and virtual storage, CD-ROMs, DVDs, and any other digital source such as a network or the Internet, as well as yet to be developed digital means, with the sole exception being a transitory, propagating signal.

Claim 1:
A Communication Network Analyzer, CNA, system (<NUM>) for detecting malicious traffic flows in a network (<NUM>), the CNA system (<NUM>) comprising a computer device (<NUM>) including at least one processor (<NUM>) in communication with at least one memory area (<NUM>), wherein the at least one processor (<NUM>) is programmed to:
based on packet information received for a plurality of data packets transmitted over the network (<NUM>), calculate inter-arrival times (<NUM>) and packet durations (<NUM>) for the plurality of data packets;
filter the packet information to remove noise;
adjust the inter-arrival times (<NUM>) for the plurality of data packets to remove one or more gaps;
compute inter-arrival rate (<NUM>) for the plurality of data packets based on the packet information;
compute median inter-arrival rate (<NUM>) for the plurality of data packets; and
adjust the inter-arrival times (<NUM>) to remove the one or more gaps based on the median inter-arrival rate (<NUM>);
generate at least one histogram (<NUM>) based on the packet information, the inter-arrival times (<NUM>), and the packet durations (<NUM>);
apply a detection criterion to the histogram results of the plurality of data packets to filter the packet information to remove the noise;
generate a power spectral density estimate based on the packet information, the inter-arrival times (<NUM>), and the packet durations (<NUM>);
analyze the at least one histogram (<NUM>) and the power spectral density estimate to detect one or more unexpected data flows; and
report the one or more unexpected data flows.