The invention includes a method and apparatus for generating a coincidence count table adapted for determining at least one flow statistic. The method includes receiving a plurality of packets comprising a respective plurality of payloads, comparing payloads associated with consecutive ones of the plurality of packets for identifying at least one simple pattern included within the compared payloads of the consecutive ones of the plurality of packets, for each of the consecutive ones of the plurality of packets, if the at least one simple pattern is identified, processing the at least one simple pattern to form a complex pattern, and for each complex pattern, updating a coincidence count associated with the complex pattern, wherein the coincidence counts are adapted for determining at least one flow statistic.