Patent ID: 8611219

Claim:
A method of detecting anomalies in a communication system, comprising: providing a first packet flow portion and a second packet flow portion; extracting samples of a symbolic packet feature associated with traffic status of the first and second packet flow portions; computing from said extracted samples a first statistical concentration quantity and a second statistical concentration quantity of the symbolic feature associated with the first and second packet flow portions, respectively, wherein computing said first and second statistical concentration quantities comprises: computing a sample number representing the number of samples associated with one of said first and second packet flow portions; computing relative frequencies; computing quadratic values from said relative frequencies; and computing a quadratic concentration measure, wherein the quadratic concentration measure comprises a sum of the quadratic values; computing from said concentration quantities a variation quantity representing a concentration change from the first packet flow portion to the second packet flow portion, comparing the variation quantity with a comparison value; and detecting an anomaly in the system in response to said comparison.