Patent ID: 8516580

Claim:
A computer-implemented method for detecting unexpected file or packet types, comprising the steps of: receiving a file or packet to be tested, the file or packet formed from a sequential series of information units, each information unit within the file or packet included within a predetermined set of information units; computing a first information unit-pair entropy density measurement for the received file or packet using a first probability matrix which tabulates probabilities of occurrence for each possible sequential pair of information units of the predetermined set of information units; and comparing the first computed information unit-pair entropy density measurement with a threshold associated with a first expected file or packet type and determining whether the received file or packet is of an unexpected file or packet type or of the first expected file or packet type; wherein the information unit-pair entropy density measurement is calculated based on a relation between each sequential pair of information units within a received file or packet and a corresponding entry in the first probability matrix for such sequential pair of information units.