System and method for detecting rogue traffic using flow statistics with a list of authorized engines
View Patent ↗Disclosed herein are systems, methods, and non-transitory computer-readable storage media for determining rogue traffic using flow statistics and a list of authorized media engines. A system configured according to this disclosure receives data associated with a group of packets in a media queue, such as the source network address where the packets originated, the destination network address for the packets, and an indication of an associated queue for the packets. The system then verifies the data received by comparing the source network address to a list of network addresses of known media engines. The system further verifies that the indication of an associated queue for the packets is correct for the packets. Should the system detect failure in the verification of known media engines or the verification of indication of associated queues, the system generates a notification.
1. A method comprising:
receiving data associated with a plurality of packets in a media queue, wherein the data comprises a source network address, a destination network address, and an indication of an associated queue for the plurality of packets;
verifying, via a processor performing a first test, the data to a list of network addresses of known media engines;
verifying, via a second test, that the indication of the associated queue is correct for the plurality of packets; and
when at least one of the first test and the second test fails, generating a notification.
2. The method of claim 1 , wherein the data further comprises at least one of a modulation type, a protocol, a bandwidth size, a data size, and a transmission duration.
3. The method of claim 1 , wherein the first test and the second test are performed in sequence.
4. The method of claim 1 , wherein the first test and the second test are performed simultaneously.
5. The method of claim 1 , further comprising using the notification to generate a report.
6. The method of claim 1 , further comprising communicating the notification to an administrator.
7. The method of claim 6 , wherein the notification is communicated via an email.
8. A system comprising:
a processor; and
a non-transitory computer-readable storage medium having stored therein instructions which, when executed on the processor, perform a method comprising:
receiving data associated with a plurality of packets in a media queue, wherein the data comprises a source network address, a destination network address, and an indication of an associated queue for the plurality of packets;
verifying, via a first test, the data to a list of network addresses of known media engines;
verifying, via a second test, that the indication of the associated queue is correct for the plurality of packets; and
when at least one of the first test and the second test fails, generating a notification.
9. The system of claim 8 , wherein the data further comprises at least one of a modulation type, a protocol, a bandwidth size, a data size, and a transmission duration.
10. The system of claim 8 , wherein the first test and the second test are performed in sequence.
11. The system of claim 8 , wherein the first test and the second test are performed simultaneously.
12. The system of claim 8 , further comprising using the notification to generate a report.
13. The system of claim 8 , further comprising communicating the notification to an administrator.
14. The system of claim 13 , wherein the notification is communicated via an email.
15. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a computing device, cause the computing device to perform steps comprising:
receiving data associated with a plurality of packets in a media queue, wherein the data comprises a source network address, a destination network address, and an indication of an associated queue for the plurality of packets;
verifying, via a first test, the data to a list of network addresses of known media engines;
verifying, via a second test, that the indication of the associated queue is correct for the plurality of packets; and
when at least one of the first test and the second test fails, generating a notification.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the data further comprises at least one of a modulation type, a protocol, a bandwidth size, a data size, and a transmission duration.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the first test and the second test are performed in sequence.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the first test and the second test are performed simultaneously.
19. The non-transitory computer-readable storage medium of claim 15 , further comprising using the notification to generate a report.
20. The non-transitory computer-readable storage medium of claim 15 , further comprising communicating the notification to an administrator.