Methods and systems for simultaneously detecting short and long term periodicity for traffic flow identification

1. A method of analyzing communication in a network, comprising:

obtaining time of arrival information for chunks of data in the network;

constructing a signal to represent the time of arrival information;

processing the signal to obtain periodicity information about both short-term periodicity and long-term periodicity of the signal, wherein the processing includes:

generating a spectrogram that plots arrival frequency of the chunks of data against time from the signal, and

constructing a cepstrogram that contrasts short-term arrival periods of data chunks against long-term periods from the spectrogram, wherein the constructing a cepstrogram includes performing cepstrum processing on both rows and columns of the spectrogram;

generating a signature associated with the chunks of data from the short-term and long-term periodicity of the signal; and

classifying a type of the communication associated with the chunks of data using the signature,

wherein the short-term and long-term periodicity of the signal is used to generate the signature associated with the chunks of data, even when the data is encrypted.

2. The method of claim 1 , wherein the time of arrival information includes at least one of a node on the network that transmitted the chunk of data, a duration of the chunk of data, and a node on the network that will receive the chunk of data.

3. The method of claim 1 , wherein the network is a wireless network.

4. The method of claim 1 , wherein the network is a wired network.

5. The method of claim 1 , wherein the constructing includes:

encoding times of arrival as impulses or pulses using uniform sampling of the time of arrival information.

6. The method of claim 1 , wherein the generating includes:

computing a plurality of periodograms from the signal, each periodogram corresponding to a discrete time period within the signal.

7. The method of claim 1 , wherein the periodicity information contrasts the short-term periodicity and the long-term periodicity of the signal.

8. The method of claim 1 , further comprising:

classifying a communication associated with the chunks of data using the periodicity information.

9. A method of processing a communication signal, comprising:

computing a plurality of periodograms from the signal that represents time of arrival information for data in a network, each of the periodograms being generated from a portion of the signal;

combining the plurality of periodograms in time sequence to form a spectrogram containing the periodograms;

generating a cepstrogram by performing cepstrum processing on the spectrogram, wherein the generating a cepstrogram includes:

performing cepstrum processing on at least one of rows of the spectrogram and columns of the spectrogram, wherein the performing cepstrum processing includes:

performing cepstrum processing on the rows of the spectrogram to obtain a cepstrogram that reflects short-term and long-term periodic behavior of the signal;

generating a signature based on short-term and long-term periodic behavior of the signal; and

classifying a type of communication that contained the data using the signature,

wherein the short-term and long-term behavior of the signal is used to generate the signature, even when the data is encrypted.

10. The method of claim 9 , wherein the computing includes:

computing each of the periodograms using a Discrete Fourier Transform (DFT).

11. The method of claim 9 , wherein the computing includes:

computing each of the periodograms using a Welch averaged periodogram procedure.

12. The method of claim 9 , wherein the performing includes:

performing cepstrum processing on the rows of the spectrogram to obtain a cepstrogram that reflects long-term periodic behavior of the signal.

13. The method of claim 9 , wherein the performing includes:

performing cepstrum processing on the columns of the spectrogram to obtain a cepstrogram that reflects short-term periodic behavior of the signal.

14. The method of claim 13 , wherein the generating further includes:

performing cepstrum processing on the rows of the cepstrogram to obtain another cepstrogram that reflects short-term periodic behavior and long-term periodic behavior of the signal.

15. The method of claim 14 , further comprising:

classifying a communication associated with the signal using the another cepstrogram.

16. A computer-readable storage medium that stores instructions executable by one or more processors to perform a method for processing a signal, comprising:

instructions for computing a plurality of periodograms from the signal that represents time of arrival information for data in a network, each of the periodograms being generated from a portion of the signal;

instructions for combining the plurality of periodograms to form a spectrogram;

instructions for generating a cepstrogram from the spectrogram,

wherein the instructions for generating a cepstrogram include:

instructions for performing cepstrum processing on at least one of rows of the spectrogram and columns of the spectrogram, wherein the instructions for performing cepstrum processing include:

instructions for performing cepstrum processing on both the rows of the spectrogram and the columns of the spectrogram to obtain the cepstrogram that reflects short-term and long-term periodic behavior of the signal;

instructions for generating a signature based on short-term and long-term periodic behavior of the signal; and

instructions for classifying a type of communication that contained the data using the signature,

wherein the short-term and long-term behavior of the signal is used to generate the signature, even when the data is encrypted.

17. The medium of claim 16 , further comprising:

instructions for classifying a communication associated with the signal using the cepstrogram.

18. A communication tap in a network, comprising:

means for obtaining time of arrival information for chunks of data in the network;

means for constructing a signal from the time of arrival information; and

means for processing the signal to obtain information relating short-term periodicity of the signal to long-term periodicity of the signal, wherein the means for processing includes:

means for generating a spectrogram that plots arrival frequency of the chunks of data against time from the signal, and

means for constructing a cepstrogram that contrasts short-term arrival periods of data chunks against long-term periods from the spectrogram, wherein means for the constructing a cepstrogram includes means for performing cepstrum processing on both rows and columns of the spectrogram;

means for generating a signature associated with the chunks of data from the short-term and long-term periodicity of the signal; and

means for classifying a type of communication associated with the chunks of data using the signature,

wherein the short-term and long-term periodicity of the signal is used to generate the signature associated with the chunks of data, even when the data is encrypted.

19. The communication tap of claim 18 , further comprising:

means for classifying a communication associated with the chunks of data according to the information relating short-term periodicity of the signal to long-term periodicity of the signal.