Automated detection of TCP anomalies

摘要

One embodiment relates to an automated method of detecting transmission control protocol (TCP) anomalies. A TCP connection is selected to be monitored. Packets communicated for the TCP connection are scanned in chronological order of packet communication times. A signature is created for the connection based on the scanned packets, and said signature is characterized to detect anomalous behavior of the TCP connection being monitored. Other embodiments, aspects and features are also disclosed.