Patent ID: 8339979

Claim:
Method for detecting a single data flow in an aggregate packet data flow and for identifying an application generating said single data flow, said aggregate packet data flow being divided in messages, each message comprising a plurality of blocks, each block (g) of said plurality of blocks having n bits for identifying 2 n possible block values (i), said method being characterized in that it comprises the following steps: a) providing, for each block value (i), an expected frequency value (E i ), b) measuring, for a predefined number (G) of blocks (g) of said plurality of blocks, the frequency values (O i g ) which each block (g) identifies each block value (i) so as to obtain a plurality of measured frequency values (O i g ), c) processing, for each block (g), said plurality of measured frequency values (O i g ) and the expected frequency values (E i ) for generating a frequency deviation value (χ g 2 ) representative of the deviation of the plurality of measured frequency values (O i g ) with respect to the expected frequency values (E i ), d) processing the frequency deviation values (χ g 2 ) generated for each block (g) with at least one frequency deviation threshold value (χ th ) for detecting said single data flow in said aggregate packet data flow and for identifying the application generating said single data flow.