Monitoring network traffic to determine similar content

A method for monitoring data streams through routers in a connectivity service provider environment, the method comprising:

• retrieving, from a database, a plurality of stream signatures and a plurality of data streams relayed through a plurality of routers in the connectivity service provider environment;
• classifying the plurality of stream signatures into a number of classes, wherein each class identifies a group of stream signatures most resembling each other;
• and
• identifying a data stream simultaneously relayed through at least two routers in the connectivity service provider environment, wherein the identifying is based on examining stream signatures in a class, and determining at least two stream signatures within the class that have substantially similar time-stamp information.

A computer-implemented system comprising memory and one or more processors coupled to the memory and configured to:

• retrieve, from a database, a plurality of stream signatures corresponding to a pre-determined period of time, and a plurality of data streams relayed through a plurality of routers in a connectivity service provider environment;
• classify the plurality of stream signatures into a number of classes, wherein each class identifies a group of stream signatures most resembling each other;
• and
• identify a data stream simultaneously relayed through at least two routers in the connectivity service provider environment, wherein the identifying is based on examining stream signatures in a class, and determining at least two stream signatures within the class that have substantially similar time-stamp information.

A program storage device tangibly embodying a program of instructions executable by at least one machine to perform a method for monitoring data streams in a connectivity service provider environment, the method comprising:

• monitoring a plurality of data streams passing through a router in the connectivity service provider environment;
• for each of the data streams:
• periodically sampling received packets at the router;
• generating a stream signature based at least on a payload of the sampled packets;
• for each generated stream signature:
• attaching time-stamp information to the stream signature;
• attaching an identification of the router to the stream signature;
• and
• storing the stream signatures corresponding to the data streams in a database,
• wherein at least two stream signatures stored in the database are compared to determine whether the corresponding data streams are similar.