Statistical object identification

A method comprising:

• accepting as input to a device (10) communication of a first statistical object (14F) having communications characteristics (22), the device (10) comprising therein a plurality of statistical objects (14P), each of the plurality of statistical objects comprising a statistical representation of a corresponding original object (12S), the device comprising storage for a plurality of attack objects (13P), each of the plurality of statistical objects (14P) and the plurality of attack objects (13P) including a timestamp (15), the device (10) comprising a statistical object matcher (18), an accumulated statistical object selector (20), an accumulated statistical object (14A) and a plurality of matching statistical objects (14MP), a first associated original object selector (24), a second associated original object identifier (28) and a table for storing the plurality of statistical objects (14P) and plurality of original objects (12P) and a probability calculator (30);
• using the statistical object matcher (18) determining if said first statistical object (14F) matches at least one of said plurality of statistical objects (14P);
• using the statistical object matcher (18) to generate an attack measurement (13) when the first statistical object (14F) matches none of said plurality of statistical objects;
• accumulating with the accumulated statistical object selector (20) said first statistical object (14F) and a plurality of matching statistical objects (14MP) in the accumulated statistical object (14A) identified by said communications characteristics (22);
• using the first associated original object selector (24) the select an original object (12SEL) identified by said communications characteristics (22);
• using the second associated original object identifier (28) to determine if said accumulated statistical object (14A) can be produced by said selected original object (12SEL);
• generating an accumulated attack measurement (13A) from said plurality of attack measurements (13P) that occurred during a time period during which said accumulated statistical object (14A) was accumulated;
• determining with the probability calculator (30) a calculated probability (36) of guessing said accumulated statistical object (14A) based on said accumulated statistical object (14A) and the number of statistical objects in said plurality of said statistical objects (14P) produced by original objects associated with said associated communications characteristics (22) and said accumulated attack measurement (13A);
• determining with a threshold comparator (32) if said calculated probability (36) is less than a threshold value (27);
• associating said communications characteristics (22) with said selected original object (212SEL);
• and
• generating an indication (34) of said selected original object (12SEL).