StealthWatch G1 scales to high-speeds because its network characterization is based on a reduced data set made up of statistical analysis of traffic flow headers. It begins by categorizing all communications between two IP devices relating to a particular process or service as one flow. Then the headers of each flow are analyzed using proprietary algorithms to determine normal and abnormal network activity. By understanding accepted network protocols/patterns, StealthWatch G1 detects suspicious activity. By building flows rather than piecing together the packets in the TCP connection, StealthWatch G1 analyzes the data on high-speed networks running on optical gigabit lines.