Patent ID: 7886358

Claim:
A method for determining unauthorized usage of a data communication network by port profiling, comprising the steps of: receiving information corresponding to a determined client/server (C/S) flow corresponding to a plurality of packets exchanged between two hosts on the data communication network that relate to a single service and is characterized by a predetermined C/S flow characteristic; storing information in a host data structure associating a service that is associated with a determined (C/S) flow with at least one of the hosts that is associated with the determined (C/S) flow, said service comprising an observed service; determining by reference to the host data structure that an observed service associated with a particular host is out of profile by comparing the observed service to a prestored allowed network services profile for the particular host; and in response to determination that an observed service associated with a particular host is out of profile, providing an output indicating that the observed service is out of profile.