System and method for detecting rogue traffic using flow statistics with a list of authorized engines

A system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium having stored therein instructions which, when executed on the processor, perform a method comprising:
• receiving data associated with a plurality of packets in a media queue, wherein the data comprises a source network address, a destination network address, and an indication of an associated queue for the plurality of packets;
• verifying, via a first test, the data to a list of network addresses of known media engines;
• verifying, via a second test, that the indication of the associated queue is correct for the plurality of packets;
• and
• when at least one of the first test and the second test fails, generating a notification.

A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a computing device, cause the computing device to perform steps comprising:

• receiving data associated with a plurality of packets in a media queue, wherein the data comprises a source network address, a destination network address, and an indication of an associated queue for the plurality of packets;
• verifying, via a first test, the data to a list of network addresses of known media engines;
• verifying, via a second test, that the indication of the associated queue is correct for the plurality of packets;
• and
• when at least one of the first test and the second test fails, generating a notification.