Patent ID: 8433788

Claim:
An overlay network traffic detection system, comprising: a plurality of data processing apparatuses that are configured to provide a plurality of traffic measurement units that are deployed on a network to receive network traffic in transit on the network and obtain statistical information about traffic flow on the network; a plurality of traffic profilers for creating traffic profiles based on the statistical information measured by the traffic measurement units; and a correlator-evaluator-thresholder for collecting and additively compiling the traffic profiles obtained by the plurality of traffic profilers, calculating an inbound-outbound correlation level between the compiled traffic profile of traffic inbound to a destination and the compiled traffic profile of outbound traffic originating from the destination, and deciding whether the inbound-outbound correlation level exceeds a first threshold value, wherein each of the plurality of traffic profilers performs a frequency component analysis of a combination of two or more of packet length distribution, packet arrival time spacing distribution, and traffic volume distribution in a plurality of time intervals, wherein the correlator-evaluator-thresholder decides whether a node in the network is an overlay network node or not by testing for similarity between results of frequency component analyses of the node's inbound traffic and the node's outbound traffic, wherein the correlator-evaluator-thresholder tests for similarity by comparing a shape of a spectrum of the node's inbound traffic and a shape of a spectrum of the node's outbound traffic, and wherein the correlator-evaluator-thresholder tests for similarity by comparing a curved surface representing the spectrum of the node's inbound traffic with a curved surface representing the spectrum of the node's outbound traffic in a three-dimensional Cartesian coordinate system with axes representing frequency, magnitude, and time.