Patent ID: 7917953

Claim:
A method of classifying disruptive data packet traffic flow on a network, comprising: obtaining at a router, periodograms based on times of arrival of said data packets from nodes of said network; comparing successive periodograms for each of said nodes to determine when at least one new peak above a threshold is present in one of said periodograms for one of said nodes; marking said at least one new peak as a suspicious peak when said at least one new peak does not occur in one of a predetermined number of previous periodograms for said one of said nodes; determining if said suspicious peak occurs in at least one of a specified number of periodograms obtained at said router for others of said nodes of said network; determining if said suspicious peak occurs in at least one of said specified number of periodograms obtained at other routers for said one of said nodes; and providing a signal to classify traffic flow corresponding to said suspicious peak as disruptive traffic flow when said suspicious peak occurs at least in at least one of said specified number of periodograms obtained at said router for said others of said nodes and in at least one of said specified number of periodograms obtained at said other routers for said one of said nodes.