Back to results
US 12,602,383 B2Granted
Normalization and extraction of log data
AssigneeThreatSTOP, Inc.
InventorFrancis Turner
Life of this patent
Estimating the term…
Abstract
Extracting data from traffic logs using regular expressions. A traffic log is received from a network device. A characterization of an extraction of data from the traffic log is determined. The traffic log is parsed by applying a first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data. Data is extracted from the traffic log by applying a second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
Claims20
A method comprising:
- detecting an initial connection of a network device;
- sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device;
- receiving the traffic log from the network device;
- selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log;
- parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- selecting a second regular expression based on the characterization of the extraction of data from the traffic log;
- extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
4 more elements
A system comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the system to perform:
- detecting an initial connection of a network device;
- sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device;
- receiving the traffic log from the network device;
- selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log;
- parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- selecting a second regular expression based on the characterization of the extraction of data from the traffic log;
- extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
7 more elements
A system comprising:
- means for detecting an initial connection of a network device;
- means for sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device;
- means for receiving the traffic log from the network device;
- means for selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log;
- means for parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
- means for selecting a second regular expression based on the characterization of the extraction of data from the traffic log;
- means for extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.
4 more elements
Dependencies are inferred from the claim text.