Patent ID: 7290283

Claim:
A method for determining unauthorized usage of a data communication network, comprising the steps of: monitoring packet headers of packets exchanged between two hosts on the data communication network; based on the packet headers, determining the existence of a client/server (C/S) flow corresponding to a predetermined plurality of packets exchanged between the two hosts that relate to a single service and is characterized by a predetermined C/S flow characteristic; storing information associating a service that is associated with a determined C/S flow with at least one of the hosts that is associated with the determined C/S flow, said service comprising an observed service; determining if an observed service associated with a particular host is out of profile by comparing the service to a prestored allowed network services profile for the particular host; and in response to determination that an observed service associated with a particular host is out of profile, providing an output indicating that the observed service is out of profile.