METHODS AND SYSTEMS FOR PASSIVE INFORMATION DISCOVERY USING LOMB PERIODOGRAM PROCESSING

• US 20080046549A1
• Filed: 09/13/2002
• Published: 02/21/2008
• Est. Priority Date: 10/16/2001
• Status: Active Grant

• Current Assignee: Raytheon BBN Technlogies Corp. (Rtx Corporation)
• Original Assignee: BBN Technologies (Rtx Corporation)
• Inventors: Saxena, Tushar, Partridge, Craig, Strayer, W. Timothy, Cousins, David B.
• Granted Patent: US 7,359,966 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A system processes communication signals in a network [100, 200]. The system may obtain time of arrival information for chunks of data in the network and construct a signal [410, 420] represent the time of arrival information. The signal may consist of data that is non-uniformly spaced. The system may process the signal using a Lomb technique to obtain periodicity information [600, 800] about the signal.

Claims

1. A method of analyzing communication from nodes in a network, comprising:

obtaining time of arrival information for chunks of data in the network;

constructing a signal to represent the time of arrival information, the signal consisting of data that is non-uniformly spaced; and

processing the signal using a Lomb technique to obtain periodicity information about the signal.

2. The method of claim 1, wherein the time of arrival information includes at least one of identification of a node on the network that transmitted the chunk of data, a duration of the chunk of data, and identification of a node on the network that will receive the chunk of data.

3. The method of claim 1, wherein the network is a wireless network.

4. The method of claim 1, wherein the network is a wired network.

5. The method of claim 1, wherein the constructing includes:

encoding times of arrival as impulses or pulses.

6. The method of claim 5, wherein the encoding includes:

assigning a sign to the impulses or pulses based on which node sent a chunk received at the time of arrival.

7. The method of claim 1, wherein the processing includes:

performing Lomb processing on the signal to obtain spectral power information for the signal versus time or frequency.

8. The method of claim 7, further comprising:

classifying data flow in the network using the spectral power information.

9. The method of claim 8, wherein the classifying further includes:

determining a number of different data flows in the network based on the spectral power information.

10. The method of claim 8, wherein the classifying further includes:

determining types of data flows in the network based on the spectral power information.

11. The method of claim 8, wherein the classifying further includes:

deriving time intervals associated with particular network applications from the spectral power information.

12. The method of claim 11, wherein the classifying further includes:

estimating a physical distance between nodes running the network applications from the time intervals.

13. The method of claim 8, wherein the classifying further includes:

deriving time intervals associated with particular network protocols from the spectral power information.

14. The method of claim 13, wherein the classifying further includes:

estimating a physical distance between nodes employing the network protocols from the time intervals.

15. The method of claim 1, further comprising:

analyzing data flow in the network using the periodicity information.

16. A method of processing communication signals from nodes in a network, comprising:

obtaining time of arrival information for chunks of data in the network;

constructing a signal to represent the time of arrival information, the signal including data that is non-uniformly spaced; and

processing the signal using a Lomb technique to obtain periodicity information about the signal.

17. The method of claim 16, wherein the constructing includes:

encoding times of arrival of the chunks as impulses or pulses.

18. The method of claim 17, wherein the encoding includes:

assigning a sign to the impulses or pulses based on which node sent the chunks.

19. The method of claim 16, wherein the periodicity information includes a power spectrum of the signal.

20. The method of claim 16, further comprising:

classifying data flow in the network using the periodicity information.

21. The method of claim 20, wherein the classifying further includes:

determining a number of different data flows in the network based on the periodicity information.

22. The method of claim 20, wherein the classifying further includes:

determining types of data flows in the network based on the periodicity information.

23. A method of processing communication signals, comprising:

obtaining time of arrival information for chunks of information in a network;

generating a signal containing non-uniformly spaced data that represent the times of arrival of chunks of information in the network; and

processing the signal using a Lomb technique to obtain periodicity information about the signal and to obtain power of the signal versus time or frequency.

24. The method of claim 23, further comprising:

classifying data flow in the network using the power of the signal.

25. A computer-readable medium that stores instructions executable by one or more processors to perform a method for processing a signal, comprising:

instructions for obtaining time of arrival information for chunks of information in a network;

instructions for generating a signal containing non-uniformly spaced data that represent the times of arrival of chunks of information in the network; and

instructions for processing the signal using a Lomb technique to obtain periodicity information about the signal and to obtain power of the signal versus time or frequency.

26. The computer-readable medium of claim 25, wherein the instructions for processing include:

instructions for determining a number of data flows in the network by counting prominent peaks in the power of the signal.

27. A communication tap in a network, comprising:

means for capturing chunks of data in the network;

means for determining time of arrival information for the chunks of data;

means for generating a signal to represent the time of arrival information, the signal consisting of data that is non-uniformly spaced; and

means for processing the signal using a Lomb technique to obtain periodicity information about the signal.

28. The communication tap of claim 27, further comprising:

means for analyzing data flow in the network using the periodicity information.