Patent ID: 7852775

Claim:
Method for determining if an encrypted flow of packets (F) belongs to a predefined class of flows (ω t ), where said encrypted flow of packets (F) comprises an ordered sequence of authentication packets and data packets (Pkt i ), where each packet (Pkt i ) can be represented by at least two measurable variables (s,Δt), said method comprising the steps of: a) providing, for each packet position (i) in an ordered sequence of packets (Pkt i ), a probability density function (p(x i |ω t )) of the values of the at least two measurable variables in a plurality of encrypted flows of packets (F j ) belonging to said predefined class of flows (ω t ) b) measuring the values (s i ,Δt i ) of said at least two measurable variables, for each packet (Pkt i ) of a plurality of packets of said encrypted flow of packets (F), c) applying said measured values (s i ,Δt i ) to the probability density function (p(x i |ω t )) of the respective packet position (i) to generate a sequence of values of probability density (p({right arrow over (x)}|ω t )), for each packet (Pkt i ) of said plurality of packets of said encrypted flow of packets (F), said steps b) and c) being applied to the data packets of the encrypted flow of packets (F), d) processing the sequence of values of probability density (p({right arrow over (x)}|ω t ) to generate a reference value (S({right arrow over (x)}|ω t )), e) comparing said reference value (S({right arrow over (x)}|ω t )) to a threshold value (T) to determine if said encrypted flow of packets (F) belongs to said class of flows (ω t ).