METHOD FOR DETECTING SYSTEMATIC COMMUNICATIONS IN A COMMUNICATIONS NETWORK, CORRESPONDING DEVICE, AND COMPUTER PROGRAM PRODUCT

Abstract

Described herein is a method for detecting systematic communications in a communications network (10, 30). The method comprises repeating the following steps for each data packet (DP) of a sequence of a plurality of data packets (DP) sent through the communication network (10, 30) from a respective source to a respective destination:

obtaining (1002, 1004) metadata (MD) of the data packet (DP), wherein the metadata (MD) include both data that identify the source and/or the destination and data that identify a sending time (t) when the data packet (DP) has been sent;

verifying (1022) whether the data packet (DP) belongs to a specific type of communication by checking whether the metadata (MD) indicate the fact that the data packet (DP) has been sent by a given source and/or received by a given destination, and in the case where the metadata (MD) indicate that the data packet (DP) has been sent by a given source and/or is received by a given destination, computing (1024) a value of variance for the given type of communication; and

comparing (1012) the value of variance with a threshold (TH), and in the case where the value of variance is less than the threshold, generating (1014) a notification that indicates the fact that the given type of communication is systematic.

In particular, the value of variance is calculated by means of an iterative procedure.

Claims

1. A method of detecting systematic communications in a communication network, wherein the method comprises repeating the following steps for each data packet (DP) of a sequence of a plurality of data packets (DP) transmitted via said communication network from a respective source to a respective target: obtaining metadata (MD) for said data packet (DP), wherein said metadata (MD) include data which identify said source and/or said target, and data which identify a transmission time (t) where said data packet (DP) has been sent; verifying whether said data packet (DP) belongs to a given type of communication by verifying whether said metadata (MD) indicate that said data packet (DP) has been sent by a given source and/or has been received by a given target, and in case said metadata (MD) indicate that said data packet (DP) has been sent by a given source and/or has been received by a given target, computing a variance value Var for said given type of communication; comparing said variance value Var with a threshold (TH), and in case said variance value Var is smaller than said threshold, generating a notification which indicates that said given type of communication is systematic; wherein said computing said variance value Var for said given type of communication comprises: verifying whether an ordered list (D) is empty, in case said ordered list (D) is empty, adding said transmission time (t) as first element (d.sub.0) to said ordered list (D), and setting a sum of squares value s.sub.sq to zero, in case said ordered list (D) is not empty, comparing said transmission time (t) with the transmission times stored in said ordered list (D), and in case said transmission time (t) is greater than the transmission time of the last element (d.sub.k−1) in said ordered list (D): a) computing the difference between said transmission time (t) and the transmission time of the last element (d.sub.k−1) of said ordered list (D), b) updating said ordered list (D′) by adding said transmission time (t) as new last element (d′.sub.k) to the end of said ordered list (D), and c) updating said sum of squares value s.sub.sq by adding the square of said difference; in case said transmission time (t) is smaller than the transmission time of the first element in said ordered list (D): a) computing the difference between the transmission time of the first element (d.sub.0) of said ordered list (D) and said transmission time (t), b) updating said ordered list (D′) by adding said transmission time (t) as new first element (d′.sub.0) at the beginning of said ordered list (D), and c) updating said sum of squares value s.sub.sq by adding the square of said difference; in case said transmission time (t) is greater than the transmission time of the first element (d.sub.0) in said ordered list (D) and smaller than the transmission time of the last element (d.sub.k−1) in said ordered list (D): a) determining a position (j) for inserting said transmission time (t), wherein said position corresponds to the position (j) of the element (d.sub.j) of said ordered list (D) which has a transmission time being greater than said transmission time (t) and follows the position of the immediately preceding element (d.sub.j−1) of said ordered list (D) which has a transmission time being smaller than said transmission time (t), b) computing a first difference between the transmission time of the element (d.sub.j) of said ordered list (D) in said position (j) and said transmission time (t), computing a second difference between said transmission time (t) and the transmission time of the element (d.sub.j−1) of said ordered list (D) in the position which precedes said position (j), and determining a third difference between the transmission time of the element (d.sub.j) of said ordered list (D) in said position (j) and the transmission time of the element (d.sub.j−1) of said ordered list (D) in the position which precedes said position (j), c) updating said ordered list (D′) by adding said transmission time (t) as new element (d′.sub.j) in said position (j) of said ordered list (D), and d) updating said sum of squares value s.sub.sq by adding the square of said first difference and the square of said second difference, and subtracting the square of said third difference; and determining a value k identifying the number of elements in said ordered list (D); determining a difference s.sub.sp between the transmission time of the last element (d′.sub.k) of said updated ordered list (D′) and the transmission time of the first element (d′.sub.0) of said updated ordered list (D′); and computing said variance value V ar with the following equation: $\mathrm{Var}=\frac{1}{k}{s}_{sq}-{\left(\frac{1}{k}{s}_{sp}\right)}^2$

2. The method according to claim 1, wherein said determining a third difference between the transmission time of the element (d.sub.j) of said ordered list (D) in said position (j) and the transmission time of the element (d.sub.j−1) of said ordered list (D) in the position which precedes said position (j) comprises: in case said transmission time (t) is greater than the transmission time of the last element (d.sub.k−1) in said ordered list (D): storing said difference between said transmission time (t) and the transmission time of the last element (d.sub.k−1) of said ordered list (D) within said new last element (d′.sub.k) of said updated ordered list (D′); in case said transmission time (t) is smaller than the transmission time of the first element (d.sub.0) in said ordered list (D): storing said difference between the transmission time of the first element (d.sub.0) of said ordered list (D) and said transmission time (t) as difference of the old first element (d.sub.0; d′.sub.1) of said ordered list (D); and in case said transmission time (t) is greater than the transmission time of the first element (d.sub.0) in said ordered list (D) and smaller than the transmission time of the last element (d.sub.k−1) in said ordered list (D): obtaining said third difference by reading the difference stored within the element (d.sub.j) of said ordered list (D) at said position (j), and storing said second difference within the new element (d′.sub.j) of said updated ordered list (D′) in said position (j), and storing said first difference as difference of the old element (d.sub.j; d′.sub.j+1) of said ordered list (D) in said position (j).

3. The method according to claim 1, wherein said determining a third difference between the transmission time of the element (d.sub.j) of said ordered list (D) in said position (j) and the transmission time of the element (d.sub.j−1) of said ordered list (D) in the position which precedes said position (j) comprises: obtaining said third difference by computing the difference between the transmission time stored in the element (d.sub.j) of said ordered list (D) in said position (j) and the transmission time stored in the element (d.sub.j−1) of said ordered list (D) in the position which precedes said position (j).

4. The method according to claim 1, wherein said determining a difference s.sub.sp between the transmission time of the last element (d′.sub.k) of said updated ordered list (D′) and the transmission time of the first element (d′.sub.0) of said updated ordered list (D′) comprises: in case said ordered list (D) is empty, setting a partial sum value s.sub.sp to zero, in case said transmission time (t) is greater than the transmission time of the last element (d.sub.k−1) in said ordered list (D): updating said partial sum value s.sub.sp by adding said difference between said transmission time (t) and the transmission time of the last element (d.sub.k−1) of said ordered list (D); in case said transmission time (t) is smaller than the transmission time of the first element (d.sub.0) in said ordered list (D): updating said partial sum value s.sub.sp by adding said difference between the transmission time of the first element (d.sub.0) of said ordered list (D) and said transmission time (t).

5. The method according to claim 1, comprising storing one or more variance values Var each time deleting the elements of said ordered list (D), and determining said threshold (TH) as a function of said one or more variance values Var.

6. The method according to claim 5, wherein said threshold (TH) is determined via a statistical analysis or a machine learning algorithm configured to analyze said one or more variance values Var.

7. The method according claim 1, wherein said data packets (DP) are data packets of the TCP/IP or UDP/IP protocol, wherein said data packet (DP) comprise a source IP address, a target IP address and a target port, and wherein said verifying whether said data packet (DP) belongs to a specific type of communication comprises verifying whether said metadata (MD) indicate that said data packet (DP): has been sent from a given source IP address to a given target IP address; or has been sent from a given source IP address to a given target port.

8. The method according to claim 1, wherein said data packets (DP) are Ethernet data packets comprising data packets of the IP protocol, wherein said data packets (DP) comprise a source MAC address and a source IP address, and wherein said verifying whether said data packet (DP) belongs to a specific type of communication comprises verifying whether said metadata (MD) indicate that said data packet (DP): is an Address Resolution Protocol request sent from a given source MAC address and/or a given source IP address; or is an “echo” request of the Internet Control Message Protocol sent from a given source MAC address and/or a given source IP address.

9. A device configured to implement the method according to claim 1.

10. A computer-program product that can be loaded into non-transitory memory that is coupled to at least one processor, wherein the computer program comprises software code that, when executed by said at least one processor, implementsts operations comprising: the method according to claim 1.

Description

BRIEF DESCRIPTION OF THE FIGURES

[0047] The embodiments of the present disclosure will now be described with reference to the annexed drawings, which are provided purely by way of non-limiting example, and in which:

[0048] FIG. 1 shows an example of a communications system comprising a network-security monitoring platform;

[0049] FIG. 2 shows a first embodiment of operation of a network-security monitoring platform, where the platform computes a value of variance;

[0050] FIGS. 3 and 4 show a second embodiment of operation of a network-security monitoring platform, where the platform computes a value of variance; and

[0051] FIGS. 5, 6A, 6B, 6C, 6D, and 6E show details of operation of the platform of FIGS. 3 and 4.

DETAILED DESCRIPTION

[0052] In the ensuing description, numerous specific details are provided to enable an in-depth understanding of the embodiments. The embodiments may be implemented without one or more of the specific details, or with other methods, components, materials, etc. In other cases, operations, materials or structures that are well known are not represented or described in detail so that the aspects of the embodiments will not be obscured.

[0053] Reference throughout this description to “an embodiment” or “one embodiment” means that a particular characteristic, distinctive element, or structure described with reference to the embodiment is comprised in at least one embodiment. Hence, the use of the phrase “in an embodiment” or “in one embodiment” in various parts of this description do not necessarily refer all to one and the same embodiment. Moreover, the particular characteristics, the distinctive elements, or the structures may be combined in any way in one or more embodiments.

[0054] The references appearing herein are provided only for convenience and do not define the sphere of protection or the scope of the embodiments.

[0055] In the ensuing FIGS. 2 to 5, the parts, elements, or components that have already been described with reference to FIG. 1 are designated by the same references as those used previously in this figure; the description of these elements that have been described previously will not be repeated hereinafter in order not to overburden the present detailed description.

[0056] As mentioned previously, the present disclosure provides solutions for detecting systematic communications, which may be an indicator of the presence of malware. In fact, unlike human behaviour, the communications made by malicious software may be characterized by a low latency and a marked periodicity.

[0057] FIG. 2 shows a first embodiment of a method for detecting systematic communications. For example, this method can be implemented within a computer 40a configured for implementing a network-security monitoring platform (NSMP), also identified as Security Network Monitoring Platform (SNMP), for example via software code and/or hardware components. For a general description of such an SNMP platform, reference may be made to the description of FIG. 1.

[0058] After a starting step 1000, the computer 40a receives in a step 1002 data packets DP from one or more data-traffic sensors. For example, as explained previously, these data packets DP may be supplied by a SPAN port 402 of a switch 100, a router and/or a firewall 20, a TAP 404, etc. In general, the computer 40a may also be integrated directly in one of the data-traffic sensors, for example within a firewall with a sufficient computational capacity.

[0059] For example, with reference to data packets DP compliant with the IP (Internet Protocol), each IP (IPv4 or IPv6) packet comprises an IP source address and an IP destination address. Moreover, each IP packet may comprise:

[0060] ICMP (Internet Control Message Protocol) control data; or

[0061] data of a transport protocol, which comprises a payload and possibly further routing information, for example a TCP (Transmission Control Protocol) or the UDP (User Datagram Protocol) port.

[0062] In general, the data packets DP may even be data packets at the level of network access (link layer), for example, directly the respective Ethernet frames or requests compliant with the Address Resolution Protocol (ARP). For instance, with reference to the ARP, an ARP request makes it possible to obtain the MAC (Media Access Control) address associated to a given IP address. Consequently, in general, each data packet DP typically comprises the data that identify the source of the data packet DP, for example the MAC address and/or the IP address.

[0063] Consequently, in a step 1004, the computer 40a may process the data packet DP and extract data characterizing the data packet DP. For example, a typical data packet DP may comprise, in addition to the Ethernet and/or IP headers, also a header at the level of transport protocol, such as TCP or UDP. Consequently, in various embodiments, the computer 40a may extract from these headers routing information, such as:

[0064] in the case where the data packet DP is included in an Ethernet frame, the MAC source address and possibly the MAC destination address;

[0065] in the case where the data packet DP comprises an IP packet (possibly included in an Ethernet frame), the IP source address and the IP destination address; and

[0066] in the case where the data packet DP comprises a TCP or UDP packet (possibly included in an IP packet), the respective port.

[0067] In various embodiments, the computer 40a may also extract other information from the header or headers of the data packet DP. For instance, in various embodiments, the computer 40a is configured to classify the data packets as ICMP, ARP messages, or data transmissions.

[0068] In various embodiments, the computer 40a may also process the payload of the data packet DP. For example, in various embodiments, the computer 40a may calculate a signature (e.g., a hash code) for the payload.

[0069] These characteristic data correspond thus to metadata MD that describe the data packet DP. For instance, the computer 40a may store the above metadata MD in a memory 408, for example implemented with a database. In general, the database 408 may be implemented by the computer 408 itself or by one or more further computers.

[0070] In particular, in various embodiments, the metadata MD also comprise a timestamp t. For example, for this purpose, the computer 40a may be configured with a so-called real-time clock (RTC). Consequently, when the computer 40a receives a data packet DP, the computer 40a itself may obtain the instant of reception from the RTC and store this value along with the metadata MD for the aforesaid data packet DP. Consequently, in general, the computer may associate to each data packet DP a respective time in which communication of the respective packet DP occurs.

[0071] In general, as explained previously, the data-traffic sensors may already process the data packets DP and generate (at least in part) the metadata MD; i.e., the computer 40a could receive in step 1002 directly metadata MD, and optionally also the respective data packets DP or only the respective payload. In this case, the computer 40a could even only store in step 1004 the metadata MD received.

[0072] In various embodiments, the computer 40a then determines in a step 1006 an orderly timestamp sequence T

[0073] T:=[t.sub.0, t.sub.1, . . . , t.sub.(n−1)]

[0074] where a timestamp t.sub.i is the instant in time at position i corresponding to communication of the respective data packet DP.

[0075] In particular, the computer 40a is configured for determining the sequence T for a given type of communication, such as ARP requests that comprise one and the same MAC source address, an ICMP echo request (the so-called ping), IP packets that comprise one and the same IP source address, etc. Consequently, for this purpose, the computer 40a may be configured for:

[0076] managing a plurality of sequences T, where each sequence T is associated to a respective rule for the metadata MD; and

[0077] determining whether the metadata MD of the last data packet DP.sub.(n−1) processed correspond to one of the rules and, if they do, adding the respective timestamp t, associated to the last data packet DP.sub.(n−1) to the respective sequence T.

[0078] In particular, considering that the data packets DP may have different dimensions, and/or may be processed by different computers or different processors of one and the same computer, processing of the data packets DP may require a different processing time. Furthermore, the data-traffic sensors may send the data with different propagation times. For this reason, the timestamp t.sub.i of the last data packet DP.sub.(n−1) processed does not necessarily correspond to the last element t.sub.(n−1) of the orderly sequence T, but the computer 40a is configured for inserting the timestamp in the sequence T in a position j, with 0≤j≤(n−1), in such a way that the sequence T is ordered.

[0079] Consequently, in various embodiments, the computer 40a may manage different sequences T for different source and/or destination addresses (e.g., MAC and/or IP addresses), and possibly different sequences T for the same source, for example with reference to the protocol used, etc.

[0080] For instance, to detect a so-called LAN scan, the computer 40a may be configured for managing a respective sequence T for at least one from among:

[0081] ARP requests sent by the same source;

[0082] ICMP echo requests sent by the same source; and

[0083] TCP or UDP requests for connection to a given port sent by the same source.

[0084] For example, in various embodiments, the source is identified via the respective MAC address or IP address, or the combination of the respective MAC address and IP address. Consequently, in this way, it is possible to monitor communications sent by the same source that are able to detect other computers that can be reached within the LAN 10.

[0085] Instead, to detect a so-called port scan of the same destination, the computer 40a may be configured for managing a respective sequence T for TCP or UDP connection requests sent from the same source to the same destination. For example, the source and the destination may be identified via the respective MAC address and/or IP address. Moreover, to detect brute-force attacks carried out to obtain an unauthorized access to a computer, the computer 40a may be configured for managing a respective sequence T of authentication requests between the same source and the same destination, such as authentication requests in accordance with the protocols POP3, SMTP, IMAP, HTTP, HTTPS, and/or SMB.

[0086] In general, the computer 40a could also enable specification of additional rules, for example through the terminal 406. For instance, in various embodiments, these rules may comprise one or more of the metadata MD.

[0087] In the embodiment considered, the computer 40a then computes in a step 1008 the difference between each timestamp and the previous timestamp, thus determining a sequence S:

[0088] S:=[t.sub.1-t.sub.0, t.sub.2-t.sub.1, . . . , t.sub.(n−1)-t.sub.(n−2)]=[S.sub.0, S.sub.1, . . . , S.sub.(n−2)]

[0089] In general, in the case where the computer 40a manages a number of sequences T, the computer 40a computes for each sequence T a respective sequence S.

[0090] In various embodiments, to determine the periodicity of the communication, the computer 40a computes in a step 1010 the variance Var(S) of each sequence S; namely,

[00001]$\mathrm{Var}\left(S\right)=\frac{1}{n-1}\underset{i=0}{\overset{n-2}{.Math.}}{\left(s_i-\overline{S}\right)}^2$

[0091] where S corresponds to the arithmetic mean of the values of the sequence S.

[0092] Consequently, in a step 1012, the computer 40a may verify the value of the variance Var(S) of each sequence S. In particular, in the case of automatic requests, the variance Var(S) should be low.

[0093] Consequently, in the case where the value of the variance Var(S) of a sequence S is less than a threshold TH (output “N” from the verification step 1012), the computer 40a proceeds to a step 1014, where it notifies the event to an operator, for example by sending a notification to the terminal 406 (see FIG. 1). Next, the computer 40a returns to step 1002 to receive a next data packet DP and/or metadata MD.

[0094] Instead, in the case where the value of the variance Var(S) of all the sequences S is greater than the threshold TH (output “Y” from the verification step 1012), the computer 40a may return directly to step 1002 to receive the next data packet DP and/or metadata MD.

[0095] In various embodiments, the threshold TH for each sequence S may be fixed, programmable, or determined by analysing the communications made in the absence of malware. For example, for this purpose, the computer 40a may calculate, during a training step and/or periodically, a value of variance Var(S) (as described with reference to steps 1006-1010) for a sequence S and calculate the threshold TH by multiplying the aforesaid value by a coefficient c, i.e., TH=c.Math.Var(S), with c<1, for example c=0.8.

[0096] In general, the computer 40a may also use statistical approaches. For example, in the simplest case, the computer 40a may monitor in time different sequences S, choose the minimum value Var.sub.min(S), and calculate the threshold TH by multiplying the aforesaid minimum value Var.sub.min(S) by the coefficient c.

[0097] In general, the threshold TH may be determined also via a machine-learning algorithm. For instance, in this case, a machine-learning algorithm, such as a neural network, may be trained for predicting an expected variance for a certain period of time of a given day of the week. Consequently, the mathematical model (for example, the trained neural network) receives as input the time and a datum that identifies the day of the week and supplies as output an estimate of the expected variance. Hence, the threshold TH may be calculated by multiplying the above expected variance by the coefficient c.

[0098] Consequently, in various embodiments, the computer 40a may store one or more values of variance Var erasing each time the elements of the orderly list T, and determine the threshold TH as a function of this value or these values of variance Var. In particular, for this purpose, the elements may be erased explicitly from the orderly list or implicitly by generating a new orderly list.

[0099] Consequently, through calculation of the variance, the computer 40a is able to detect the communications that occur in a systematic way. However, as explained previously, the computer 40a may even manage numerous sequences T for the various types of communications to be monitored. Moreover, each sequence T may comprise an even extremely large number of elements. Consequently, calculation of the values of the mean S and the variance Var(S) in real time may become complex.

[0100] The inventors have noted that the computational time could be reduced using an iterative calculation scheme for the variance. However, this is not easy to apply to the sequence S, since the timestamps of the data packets DP received/processed may be out of order, which would also affect the sequence of differences S.

[0101] Consequently, FIG. 3 shows a second embodiment of operation of the computer 40a.

[0102] Also in this case, the computer 40a is configured to obtain the metadata MD of a data packet DP. For the corresponding description reference may be made to the description of steps 1002 and 1004 of FIG. 2.

[0103] In the embodiment considered, a step 1022 is moreover represented, in which the computer 40a analyses the metadata MD to determine whether the data packet DP belongs to one or more communication sequences to be monitored, i.e., whether the metadata MD correspond to one or more rules. In fact, as explained previously, one and the same data packet DP could satisfy a number of rules that are associated to different communication sequences, for example:

[0104] for monitoring a LAN scan, requests having the same source and the same destination port but having different destinations; and

[0105] for monitoring a port scan, requests having the same source and different destination ports but having the same destination.

[0106] In fact, as described previously, the computer 40a should calculate for each communication sequence to be monitored a respective value of variance. For example, to distinguish the various communication sequences, the computer 40a may be configured for associating to each sequence a respective univocal code.

[0107] In particular, in the embodiment considered, the steps 1006, 1008 and 1010 have been combined in a single procedure of calculation of the variance for a given communication. Consequently, in the case where the data packet DP belongs to a number of sequences to be monitored, the procedure 1024 is carried out for each sequence. For example, to identify the sequence to which the data packet DP belongs, the computer 40a may pass, to the procedure 1024, also the univocal code that identifies a given communication sequence.

[0108] In particular, in various embodiments, the computer 40a is configured for updating the value of variance Var for a given sequence (for example, identified via a respective univocal code) in an iterative way as a function of the timestamp t of the current data packet DP that is being analysed.

[0109] Consequently, also in this case, the computer 40a may proceed to a step 1012 for comparing the value or values of variance Var that has/have been updated with respective thresholds TH, i.e., the respective threshold TH associated to the communication sequence that is being updated, and possibly may generate a notification signal in step 1014.

[0110] FIG. 4 shows an embodiment of the procedure 1024.

[0111] As explained previously, in various embodiments, the computer 40a is configured for updating the value of variance Var for a given sequence (for example, identified via a respective univocal code) in an iterative way as a function of the timestamp t of the current data packet DP that is being analysed.

[0112] Specifically, in various embodiments, the variance is calculated using the following simplified equation:

[00002]$\mathrm{Var}\left(S\right)=\frac{1}{n-1}\underset{i=0}{\overset{n-2}{.Math.}}{s}_i^2-{\left(\frac{1}{n-1}\underset{i=0}{\overset{n-2}{.Math.}}{s}_i\right)}^2$

[0113] which enables separate calculation of a partial sum

[00003]$s_{sp}=\underset{i=0}{\overset{n-2}{.Math.}}{s}_i$

[0114] and a quadratic sum

[00004]$s_{sq}=\underset{i=0}{\overset{n-2}{.Math.}}{s}_i^2$

[0115] In this context, the times t of the data packets DP are not necessarily in order. For example, considering the following sequence V of times of arrival t (expressed for simplicity in milliseconds) of data packets DP of a given communication sequence:

[0116] V=[251, 450, 678, 553, 660, 719, 824, 876, 602, 184]

[0117] the corresponding orderly sequence T would be:

[0118] T=[184, 251, 450, 553, 602, 660, 678, 719, 824, 876]

[0119] Instead, the corresponding sequence S would be:

[0120] S=[67, 199, 103, 49, 58, 18, 41,105, 52]

[0121] In particular, in various embodiments, to manage sequential entry of a new element t, the computer 40a may manage a list D:

[0122] D:=[d.sub.0, d.sub.1 . . . ]=[[t.sub.0,0],[t.sub.1, s.sub.0], . . . ]

[0123] In general, instead of managing a single list D, the computer 40a could also manage one list T (for the times t) and one list S (for the differences s). However, this case is not considered specifically hereinafter, since it is only a question of a separation of the elements of the list D into two lists T and S.

[0124] Instead, as will be described in greater detail hereinafter, in various embodiments, the computer 40a may not store the differences s in the list D (or S), but only the times tin the list D. In this case, the list D hence corresponds to the list T.

[0125] Consequently, in the embodiment considered, after the step 1024 of start of the procedure, the computer 40a checks in a step 1026 whether the procedure has been started for the first time for the communication sequence that is being updated, for example whether the procedure has been started for the first time for a given univocal code. For instance, the computer 40a may check in step 1026 whether the respective list D (or likewise the list T) is empty and/or has a number of elements k equal to zero.

[0126] In the case where the procedure has been started for the first time (output “Y” from the verification step 1026), the computer 40a proceeds to an initialization step 1028, in which it initializes the list D or the list T, in particular by adding the first element:

[0127] D:=[d.sub.0]=[[t, 0]] or T:=[to]=[t]

[0128] i.e., the time t is stored as the first element do of the list D or likewise the first element t.sub.0 of the list T. For example, this is schematically shown in FIG. 6A, where the list D comprises only the element d.sub.0. Moreover, the computer 40a sets the values of the partial sum s.sub.sp(i), of the quadratic sum s.sub.sq(i) and of a variable Var(i) for the current instant (i=0) to zero.

[0129] In the embodiment considered, the computer 40a then proceeds to a step 1050, in which it increments the counter k, which hence indirectly indicates also the number of iterations i, that is, the number of the elements in the list D (or likewise T) at the next iteration. In general, the number of elements in the list D (or likewise T) could be obtained also by analysing explicitly the content of the list.

[0130] Finally, the procedure terminates in a step 1052. Consequently, with reference to the numeric example, the computer 40a adds at the first iteration (i=0) the first element d.sub.0=[251, 0] to the list D, as shown in FIG. 5.

[0131] Instead, in the case where the procedure has been started not for the first time (output “N” from the verification step 1026), the computer 40a proceeds to a verification step 1032, in which it determines whether:

[0132] the timestamp received t is less than the timestamp t.sub.0 of the first element of the list, i.e., t<t.sub.0; and

[0133] the timestamp received t is greater than the timestamp t.sub.k−1 of the last element of the list, i.e., t>t.sub.k−1.

[0134] In the case where the current timestamp t received is greater than the timestamp t.sub.k−1 of the last element of the list (output “LA” from the verification step 1032), the computer 40a updates in a step 1034 the list D (or likewise the list T) by adding a new element at the end of the list D or of the list T. The lists updated during a given iteration are denoted hereinafter, respectively, as D′ or as T, where:

[0135] D′=[d′.sub.0, . . . ]=[[6,0], . . . ], or T″=[t′.sub.0, . . . ].

[0136] The above list D′ (or likewise the list T′) does not correspond to a new list as compared to the list D (or likewise to the list T). In fact, at the next iteration the list D (or T) corresponds to the updated list D′ (or r) of the previous iteration, i.e., D(i) =D′(i−1) or T(i)=T′(i−1).

[0137] For example, as shown in FIG. 6B, in the case where the list D comprises only the element d.sub.0, i.e., k=1, the updated list D′ comprises two elements [d′.sub.0, d′.sub.1], with d′.sub.0=d.sub.0 and d′.sub.1=[t′.sub.1, s′.sub.k−1]=[t, t−t.sub.0]. Instead, as shown in FIG. 6C with reference to a generic list D with k elements, i.e., D=[d.sub.0, . . . d.sub.k−1], the updated list D′ corresponds to:

[0138] D′=[d.sub.0, . . . d.sub.k−1, d′k]

[0139] where the new element d′k can be calculated as:

[0140] d′.sub.k=[t′.sub.k, s′.sub.k−1]=[t, t−t.sub.k−1]

[0141] For instance, with reference to the numeric example, the computer 40a adds, at the second iteration (with i=1), the element d′.sub.1=[450, 199] at the end of the list D.

[0142] Likewise, the computer 40a could then add, at the end of the list T, a new element t′.sub.k=t. However, also in this case, the computer 40a computes the value s′.sub.k-1=t−t.sub.k−1, i.e., the difference between the sending time t and the sending time t.sub.k−1 of the last element of the list T.

[0143] Next, the computer 40a computes, in a step 1044, the values of the partial sum s.sub.sp(i) and of the quadratic sum s.sub.sq(i) of the current iteration (i), updating respectively the values of the partial sum s.sub.sp(i−1) and of the quadratic sum s.sub.sq(i−1) of the previous iteration (i−1) by adding, respectively, the value s′.sub.k−1 and the square of the value s′.sub.k−1:

[0144] s.sub.sp(i)=s.sub.sp(i−1)+s′.sub.j−1(i)

[0145] s.sub.sq(i)=s.sub.sq(i−1)+s′.sub.j−1(i).sup.2

[0146] Consequently, with reference to the numeric example, the computer 40a updates the value s.sub.sp to 199 and the value s.sub.sq to 39,601.

[0147] Next, the computer 40a updates, in a step 1046, the value of the variable/variance Var(i) at the iteration (i) by applying the following equation:

[00005]$\begin{array}{cc}\mathrm{Var}\left(i\right)=\frac{1}{k}{s}_{sq}\left(i\right)-{\left(\frac{1}{k}{s}_{sp}\left(i\right)\right)}^2& \end{array}$

[0148] which in any case yields, at the second iteration i=1, once again Var(1)=0, since s.sub.sq(1)=s.sub.sp(1).sup.2. In general, in this equation, the number k refers to the number of differences s that are taken into account, which corresponds to the number of elements of the (non-updated) list D.

[0149] In the embodiment considered, the computer 40a then proceeds to step 1050 for updating the value k of the elements in the list D (or likewise in the list T) for the next iteration. Consequently, in the case where the updated number k′ is used, which hence indicates the number of elements of the updated list D′, the equation used in step 1046 corresponds to:

[00006]$\mathrm{Var}\left(i\right)=\frac{1}{k^{\prime }-1}{s}_{sq}\left(i\right)-{\left(\frac{1}{k^{\prime }-1}{s}_{sp}\left(i\right)\right)}^2$

[0150] Likewise, the computer 40a, at the third iteration (with i=2), adds at the end of the list D the element d.sub.2=[678, 228], and updates the value s.sub.sp(2) to 427 and the value s.sub.sq(2) to 91,585, in this case updating also the variable Var(2) to 210.25.

[0151] Instead, in the case where the current time t received is less than the time to of the first element of the list (output “FI” from the verification step 1032), the computer 40a adds, in a step 1034, a new element at the beginning of the list D, or likewise at the beginning of the list T, i.e.,

[0152] d′.sub.0=[t, 0], or t′.sub.0=t

[0153] Consequently, in this way the other elements of the list are shifted. However, in this case, it is necessary to update the value of difference s of the old first element do, which is now in the position of the new second element d′.sub.1 of the updated list D′. Consequently, in various embodiments, the computer 40a recalculates the value of the difference of the second element d′.sub.1 as a function of the timestamp t′.sub.1 of the new second element (which corresponds to the timestamp to of the old first element do) and of the timestamp t′o of the new first element (which corresponds to the timestamp t)

[0154] d′.sub.1=[t′.sub.1, s′.sub.0]=[t.sub.0, t.sub.0−t]

[0155] In general, updating can be carried out for the element d.sub.0, i.e., prior to entry of the element d′.sub.0, or of the element d′.sub.1, i.e., after entry of the element d′.sub.0. Consequently, for a generic list D with k elements, the updated list D′ corresponds to

[0156] D′=[d′.sub.0, d′.sub.1, d.sub.1, . . . d.sub.k−1]

[0157] For example, this is shown in FIG. 6D, where the computer 40a adds the element d′.sub.0 to the list, recalculates the differences s′.sub.0 of the element d′.sub.1 as a function of the times of the elements d.sub.0 and d′.sub.0, and maintains the subsequent elements d.sub.1, . . . d.sub.k−1 as elements d′.sub.2, . . . , d′.sub.k. Likewise, in FIG. 5, the time t=184 is added at the iteration i=9 as first element d′.sub.0=[184, 0], shifting the other elements. Moreover, the computer 40a updates the value of the new second element from d.sub.0=[251, 0] to d′.sub.1=[251, 67].

[0158] Likewise, the computer 40a could then add at the start of the list T a new element t′.sub.0=t. However, also in this case, the computer 40a computes the value s′.sub.0=t.sub.0−t, i.e., the difference between the sending time t.sub.0 of the first element of the (non-updated) list D and the sending time t.

[0159] Next, the computer 40a computes, in a step 1036, the values of the partial sum s.sub.sp(i) and of the quadratic sum s.sub.sq(i) of the current iteration (i), updating respectively the values of the partial sum s.sub.sp(i - 1) and of the quadratic sum s.sub.sq(i−1) of the previous iteration (i−1). In particular, in this case, the computer 40a adds, respectively, the value s′.sub.0 and the square of the value s′.sub.0:

s.sub.sp(i)=s.sub.sp(i−1)+s′.sub.0(i)

s.sub.sq(i)=s.sub.sq(i−1)+s′.sub.0(i).sup.2

[0160] Consequently, with reference to the numeric example, the computer 40a updates, at the instant i=9, the value s.sub.sp from 625 to 692 and the value s.sub.sq from 71,709 to 76,198. Next, the computer 40a again updates, in step 1046, the value of the variable/variance Var(i) at the iteration (i) from 2860.11 to 2554.54.

[0161] Finally, in the case where the current timestamp t received is greater than the timestamp t.sub.0 of the first element of the list and less than the timestamp t.sub.k−1 of the last element of the list (output “IN” from the verification step 1032), the computer determines a position j in the list D (or likewise the list T) in which the element t is to be inserted. In particular, the position j corresponds to the position between two consecutive elements in the list D (or T) that have, respectively, a timestamp less than and a timestamp greater than the current value of t, namely, t.sub.1−1≤t≤t.sub.j, i.e., j: t.sub.j=min(t*) with t*≥t.

[0162] Consequently, as also shown in FIG. 6E, the computer 40a adds, in a step 1038, a new element d′.sub.j in position j of the list D. In particular, the above element comprises the timestamp t and the difference with respect to the previous element namely,

[0163] d′.sub.j=[t′.sub.j, s′.sub.j−1]=[t, t−t.sub.j−1]

[0164] The subsequent elements of the list D are consequently in turn shifted. Also in this case, it is necessary to update the value of difference s of the old element d.sub.j in position j, which now corresponds to the element d′.sub.j+1 in position (j+1) of the list D′, namely,

[0165] d′.sub.j+1, [t′.sub.j+1, s′.sub.j]=[t.sub.j−t]

[0166] In general, updating may be carried out for the element d.sub.j, i.e., prior to entry of the element d′.sub.j, or for the element d′.sub.j+1, i.e., after entry of the element d′.sub.j.

[0167] For example, this is shown in FIG. 5, where the time t=602 is added at the iteration i=8 after the element [553, 103] as element d′.sub.3=[602, 49], thus shifting the other elements. Moreover, the computer 40a updates the value of the old element d.sub.3 to d′.sub.4=[660, 58].

[0168] Likewise, the computer 40a may then add in position j of the list T a new element t′.sub.j=t. However, also in this case, the computer 40a computes the following values:

[0169] s′.sub.j=t.sub.j−t, i.e., the difference between the sending time t.sub.j of the element in position j and the timestamp t, and

[0170] s′.sub.j=t.sub.j−1, i.e., the difference between the timestamp t and the sending time t.sub.j-1 of the element of the orderly list D in position (j−1).

[0171] Moreover, the computer determines the value s.sub.j−1=t.sub.j−t.sub.j−t=t′.sub.j+1−t′.sub.j−1, i.e., the difference between the sending time t.sub.1 of the element d.sub.j of the (non-updated) list D in position j and the sending time t.sub.j−1 of the element d.sub.j−1 of the (non-updated) list D in position (j−1). In particular, using the list D, the aforesaid value is saved for the (non-updated) element d.sub.j=[t.sub.j, s.sub.j−1] and may thus be read before the element 4, is updated as element d′i.sub.j+1. Instead, using the list T, the aforesaid value s.sub.j−1 may be calculated. In general, this calculation may be made for the elements t.sub.j and t.sub.j−1, i.e., prior to entry of the element t′.sub.j, or for the elements t′.sub.j+1 and t′.sub.j-1, i.e., after entry of the element t′.sub.j.

[0172] Next, the computer 40a computes, in a step 1040, the values of the partial sum s.sub.sp(i) and of the quadratic sum s.sub.sq(i) of the current iteration (i), updating, respectively, the values of the partial sum s.sub.sp(i−1) and of the quadratic sum s.sub.sq(i−1) of the previous iteration (i−1). In particular, considering the entry of the new element d′.sub.j(t′.sub.j), the computer 40a is configured for adding respectively the (new) difference s′.sub.j or the square of the difference s.sub.j−1.sup.2. In addition, considering updating of the element d.sub.j/d′.sub.j+1(t.sub.j/t′.sub.j+1), the computer 40a is configured for adding respectively the (new) difference s.sub.j−1 or the square of the difference s.sub.j−1.sup.2, and removing respectively the old difference s.sub.j−1 or the square of the difference s.sub.j−1.sup.2; i.e., the computer 40a implements the following equations:

s.sub.sp(i)=s.sub.sp(i−1)+s′.sub.j−1(i)−s.sub.j−1(i)

s.sub.sq(i)=s.sub.sq(i−1)+s′.sub.j−1(i).sup.2+s′.sub.j(i).sup.2−s.sub.j−1(i).sup.2

[0173] In particular, since s′.sub.j+s′.sub.j−1=s.sub.j−1, in various embodiments, the computer 40a uses the following formula for the partial sum s.sub.sp:

s.sub.sp(i)=s.sub.sp(i−1)

[0174] Consequently, the computer 40a may even not update the partial sum s.sub.sp when an intermediate element is inserted in the list. In fact, the value s.sub.sp corresponds to the difference between the time t′k of the last element of the updated list D′ (or T) and the time t′.sub.0 of the first element of the updated list D′ (or T), i.e., s.sub.sp=t′k−t′.sub.0. Consequently, in various embodiments, instead of using the iterative scheme, the computer 40a may compute the above difference between the maximum value and the minimum value also directly on the basis of these values.

[0175] Next, the computer 40a proceeds to step 1046 for updating the value of the variable/variance Var(i) at the iteration (i). Consequently, in the considered embodiment, the computer 40a adds the timestamps t in an orderly way in the list D (or likewise 7) and possibly updates accordingly the differences s in the list D. Furthermore, the computer 40a corrects also the values of the partial sum s.sub.sp(i) and of the quadratic sum s.sub.sq(i) of the current iteration (i), taking into account any possible shifts between the elements.

[0176] Consequently, the performance depends not so much upon recalculation of the values of the partial sum s.sub.sp(i), of the quadratic sum s.sub.sq(i), and of the variance Var(i), as upon the time required for finding the correct position (0, j or k) for inserting an element tin the list. For example, since new elements are likely to be inserted for the most part at the end of a list D (or T), in various embodiments, the search for the position j in step 1038 is carried out starting from the end of the list D (or T). For example, for this purpose, the list D (or T) may be implemented with a list that comprises for each element d (or t) a pointer to the previous element (the so-called reverse-linked list), or pointers to the previous element and to the next element (the so-called doubly-linked list). For instance, for a description of the connection between the elements of a list by means of pointers reference may be made to https://en.wikipedia.org/wiki/Linked list.

[0177] Of course, without prejudice to the principles underlying the invention, the details of construction and the embodiments may vary widely with respect to what has been described and illustrated herein purely to way of example, without thereby departing from the scope of the present invention, as defined in the ensuing claims.