Methods and systems for passive information discovery using Lomb periodogram processing

1. A method of analyzing communication from nodes in a network, comprising:

obtaining time of arrival information for chunks of data in the network;

constructing a signal to represent the time of arrival information, the signal consisting of data that is non-uniformly spaced; and

processing the signal using a Lomb technique to obtain periodicity information about the signal.

2. The method of claim 1 , wherein the time of arrival information includes at least one of identification of a node on the network that transmitted the chunk of data, a duration of the chunk of data, and identification of a node on the network that will receive the chunk of data.

3. The method of claim 1 , wherein the network is a wireless network.

4. The method of claim 1 , wherein the network is a wired network.

5. The method of claim 1 , wherein the constructing includes:

encoding times of arrival as impulses or pulses.

6. The method of claim 5 , wherein the encoding includes:

assigning a sign to the impulses or pulses based on which node sent a chunk received at the time of arrival.

7. The method of claim 1 , wherein the processing includes:

performing Lomb processing on the signal to obtain spectral power information for the signal versus time or frequency.

8. The method of claim 7 , further comprising:

classifying data flow in the network using the spectral power information.

9. The method of claim 8 , wherein the classifying further includes:

determining a number of different data flows in the network based on the spectral power information.

10. The method of claim 8 , wherein the classifying further includes:

determining types of data flows in the network based on the spectral power information.

11. The method of claim 8 , wherein the classifying further includes:

deriving time intervals associated with particular network applications from the spectral power information.

12. The method of claim 11 , wherein the classifying further includes:

estimating a physical distance between nodes running the network applications from the time intervals.

13. The method of claim 8 , wherein the classifying further includes:

deriving time intervals associated with particular network protocols from the spectral power information.

14. The method of claim 13 , wherein the classifying further includes:

estimating a physical distance between nodes employing the network protocols from the time intervals.

15. The method of claim 1 , further comprising:

analyzing data flow in the network using the periodicity information.

16. A method of processing communication signals from nodes in a network, comprising:

obtaining time of arrival information for chunks of data in the network;

constructing a signal to represent the time of arrival information, the signal including data that is non-uniformly spaced; and

processing the signal using a Lomb technique to obtain periodicity information about the signal.

17. The method of claim 16 , wherein the constructing includes:

encoding times of arrival of the chunks as impulses or pulses.

18. The method of claim 17 , wherein the encoding includes:

assigning a sign to the impulses or pulses based on which node sent the chunks.

19. The method of claim 16 , wherein the periodicity information includes a power spectrum of the signal.

20. The method of claim 16 , further comprising:

classifying data flow in the network using the periodicity information.

21. The method of claim 20 , wherein the classifying further includes:

determining a number of different data flows in the network based on the periodicity information.

22. The method of claim 20 , wherein the classifying further includes:

determining types of data flows in the network based on the periodicity information.

23. A method of processing communication signals, comprising:

obtaining time of arrival information for chunks of information in a network;

generating a signal containing non-uniformly spaced data that represent the times of arrival of chunks of information in the network; and

processing the signal using a Lomb technique to obtain periodicity information about the signal and to obtain power of the signal versus time or frequency.

24. The method of claim 23 , further comprising:

classifying data flow in the network using the power of the signal.

25. A computer-readable medium that stores instructions executable by one or more processors to perform a method for processing a signal, comprising:

instructions for obtaining time of arrival information for chunks of information in a network;

instructions for generating a signal containing non-uniformly spaced data that represent the times of arrival of chunks of information in the network; and

instructions for processing the signal using a Lomb technique to obtain periodicity information about the signal and to obtain power of the signal versus time or frequency.

26. The computer-readable medium of claim 25 , wherein the instructions for processing include:

instructions for determining a number of data flows in the network by counting prominent peaks in the power of the signal.

27. A communication tap in a network, comprising:

means for capturing chunks of data in the network;

means for determining time of arrival information for the chunks of data;

means for generating a signal to represent the time of arrival information, the signal consisting of data that is non-uniformly spaced; and

means for processing the signal using a Lomb technique to obtain periodicity information about the signal.

28. The communication tap of claim 27 , further comprising:

means for analyzing data flow in the network using the periodicity information.