In one embodiment, ???plug and play??? style heuristic modules are provided, such as a module to analyze a second differential of a time domain curve representing packet 22 flow header information, a module to analyze such a curve after it has been convolved with a Bessel function with j=1, and a module to analyze a frequency spectrum based on an alternative transform function.