# US 12,602,383 B2 · Normalization and extraction of log data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,383 B2 - Document ID: US12602383B2 - Status: Granted - Kind: B2 - Application number: 18/788,090 - Filed: 2024-07-29 - Published: 2025-03-13 - Granted: 2026-04-14 - Earliest claimed: 2015-02-20 - Assignees: ThreatSTOP, Inc. - Applicants: ThreatSTOP, Inc. - Inventors: Francis Turner - Web page: https://patentgrep.com/patent/US12602383B2 ## CPC - G06F 16/2455: Query execution - G06F 40/205: Parsing - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Extracting data from traffic logs using regular expressions. A traffic log is received from a network device. A characterization of an extraction of data from the traffic log is determined. The traffic log is parsed by applying a first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data. Data is extracted from the traffic log by applying a second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data. ## Claims ### Claim 1 A method comprising: detecting an initial connection of a network device; sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device; receiving the traffic log from the network device; selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log; parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data; selecting a second regular expression based on the characterization of the extraction of data from the traffic log; extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data. ### Claim 2 (depends on 1) The method of claim 1, wherein the traffic log is received from the network device after a firewall policy of a network associated with the network device is changed. ### Claim 3 (depends on 1) The method of claim 1, further comprising parsing the traffic log by applying a plurality of regular expressions, including the first regular expression, to the traffic log according to the characterization of the extraction of data from the traffic log until an amount of the parsed data reaches a threshold amount. ### Claim 4 (depends on 1) The method of claim 1, further comprising extracting the data from the traffic log by applying a plurality of regular expressions, including the first regular expression, to the parsed data according to the characterization of the extraction of data from the traffic log until an amount of the extracted data reaches a threshold amount. ### Claim 5 (depends on 1) The method of claim 1, further comprising updating regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log based on an amount of relevant data of the extracted data. ### Claim 6 (depends on 1) The method of claim 1, further comprising updating regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log based on an amount of relevant data of the parsed data. ### Claim 7 (depends on 1) The method of claim 1, further comprising updating regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log by modifying generic regular expressions based on an amount of relevant data of the extracted data to create the specific regular expression. ### Claim 8 (depends on 1) The method of claim 1, wherein the traffic log is received from the network device when the network device joins a network. ### Claim 9 (depends on 1) The method of claim 1, wherein the traffic log is received from the network device after the network device is coupled to a log collector system. ### Claim 10 A system comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to perform: detecting an initial connection of a network device; sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device; receiving the traffic log from the network device; selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log; parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data; selecting a second regular expression based on the characterization of the extraction of data from the traffic log; extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data. ### Claim 11 (depends on 10) The system of claim 10, wherein the traffic log is received from the network device after a firewall policy of a network associated with the network device is changed. ### Claim 12 (depends on 10) The system of claim 10, wherein the instructions further cause the system to parse the traffic log by applying a plurality of regular expressions, including the first regular expression, to the traffic log according to the characterization of the extraction of data from the traffic log until an amount of the parsed data reaches a threshold amount. ### Claim 13 (depends on 10) The system of claim 10, wherein the instructions further cause the system to extract the data from the traffic log by applying a plurality of regular expressions, including the first regular expression, to the parsed data according to the characterization of the extraction of data from the traffic log until an amount of the extracted data reaches a threshold amount. ### Claim 14 (depends on 10) The system of claim 10, wherein the instructions further cause the system to update regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log based on an amount of relevant data of the extracted data. ### Claim 15 (depends on 10) The system of claim 10, wherein the instructions further cause the system to update regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log based on an amount of relevant data of the parsed data. ### Claim 16 (depends on 10) The system of claim 10, wherein the instructions further cause the system to update regular expressions data indicating a specific regular expression to apply according to specific characterizations of extractions of data from the traffic log by modifying generic regular expressions based on an amount of relevant data of the extracted data to create the specific regular expression. ### Claim 17 (depends on 10) The system of claim 10, wherein the traffic log is received from the network device when the network device joins a network. ### Claim 18 (depends on 10) The system of claim 10, wherein the traffic log is received from the network device after the network device is coupled to a log collection management engine. ### Claim 19 A system comprising: means for detecting an initial connection of a network device; means for sending a request, in response to detecting the initial connection of the network device, for a traffic log from the network device; means for receiving the traffic log from the network device; means for selecting a first regular expression based on a characterization of an extraction of data from the traffic log, the characterization based on a traffic direction represented by data in the traffic log; means for parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data; means for selecting a second regular expression based on the characterization of the extraction of data from the traffic log; means for extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data. ### Claim 20 (depends on 19) The system of claim 19, wherein the traffic log is received from the network device when the network device joins a network.