Back to results
US 10,242,062 B2Granted
Normalization and extraction of log data
AssigneeThreatSTOP, Inc.
InventorFrancis Turner
Life of this patent
Estimating the term…
Abstract
Extracting data from traffic logs using regular expressions. A traffic log is received from a network device. A characterization of an extraction of data from the traffic log is determined. The traffic log is parsed by applying a first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data. Data is extracted from the traffic log by applying a second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
Claims21
A method comprising:
- receiving a traffic log from a network device;
- determining a characterization of an extraction of data from the traffic log;
- selecting a first regular expression from a plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the first regular expression configured to generate a largest amount of relevant parsed data, compared to the plurality of regular expressions, when applied to the traffic log;
- parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- selecting a second regular expression from the plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the second regular expression configured to generate a largest amount of relevant extracted data, compared to the plurality of regular expressions, when applied to the parsed data;
- extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
3 more elements
A system comprising:
- a network device communication engine configured to receive a traffic log from a network device;
- a log data extraction characterization system configured to determine a characterization of an extraction of data from the traffic log;
- a parsed data generation engine configured to:
- select a first regular expression from a plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the first regular expression configured to generate a largest amount of relevant parsed data, compared to the plurality of regular expressions, when applied to the traffic log;
- parse the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- a data extraction engine configured to:
- select a second regular expression from the plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the second regular expression configured to generate a largest amount of relevant extracted data, compared to the plurality of regular expressions, when applied to the parsed data;
- extract data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
5 more elements
A system comprising:
- means for receiving a traffic log from a network device;
- means for determining a characterization of an extraction of data from the traffic log;
- means for selecting a first regular expression from a plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the first regular expression configured to generate a largest amount of relevant parsed data, compared to the plurality of regular expressions, when applied to the traffic log;
- means for parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- means for selecting a second regular expression from the plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the second regular expression configured to generate a largest amount of relevant extracted data, compared to the plurality of regular expressions, when applied to the parsed data;
- means for extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
3 more elements
Dependencies are inferred from the claim text.