Indexing structure with size bucket indexes

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

• to determine a set of sizes for size bucket indexes of an indexing structure;
• to associate textual string size labels with respective ones of the size bucket indexes;
• to index a plurality of records into the size bucket indexes, wherein the indexing comprises, for a given record, rounding a given record size value of the given record to a nearest one of the determined set of sizes and placing an identifier of the given record in a size bucket index associated with the nearest one of the determined set of sizes;
• to receive one or more queries to the plurality of records, a given one of the queries specifying a record size value;
• and
• to process the given query utilizing the indexing structure by mapping the specified record size value to one or more of the size bucket indexes;
• wherein mapping the specified record size value to the one or more size bucket indexes comprises:
• determining whether the specified record size value matches any of the textual string size labels;
• responsive to determining that the specified record size value matches a given one of the textual string size labels, returning each of at least a subset of the records from a given one of the size bucket indexes associated with the given textual string size label;
• and
• responsive to determining that the specified record size value does not match any of the textual string size labels, rounding the specified record size value to one or more nearest ones of the textual string size labels and returning a subset of the records matching the specified record size value from one or more of the size bucket indexes associated with the one or more nearest ones of the textual string size labels;
• wherein at least a subset of the plurality of records comprise network session records in a network sessions database;
• wherein at least a first one of the size bucket indexes comprises a first size value range associated with known malicious network sessions;
• and
• wherein at least a second one of the size bucket indexes comprises a second size value range associated with known non-malicious network sessions.

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured:
• to determine a set of sizes for size bucket indexes of an indexing structure;
• to associate textual string size labels with respective ones of the size bucket indexes;
• to index a plurality of records into the size bucket indexes, wherein the indexing comprises, for a given record, rounding a record size value of the given record to a nearest one of the determined set of sizes and placing an identifier of the given record in a size bucket index associated with the nearest one of the determined set of sizes;
• to receive one or more queries to the plurality of records, a given one of the queries specifying a record size value;
• and
• to process the given query utilizing the indexing structure by mapping the specified record size value to one or more of the size bucket indexes;
• wherein mapping the specified record size value to the one or more size bucket indexes comprises:
• determining whether the specified record size value matches any of the textual string size labels;
• responsive to determining that the specified record size value matches a given one of the textual string size labels, returning each of at least a subset of the records from a given one of the size bucket indexes associated with the given textual string size label;
• and
• responsive to determining that the specified record size value does not match any of the textual string size labels, rounding the specified record size value to one or more nearest ones of the textual string size labels and returning a subset of the records matching the specified record size value from one or more of the size bucket indexes associated with the one or more nearest ones of the textual string size labels;
• wherein at least a subset of the plurality of records comprise network session records in a network sessions database;
• wherein at least a first one of the size bucket indexes comprises a first size value range associated with known malicious network sessions;
• and
• wherein at least a second one of the size bucket indexes comprises a second size value range associated with known non-malicious network sessions.