Storing and analyzing network traffic data
AssigneeWildPackets, Inc.
InventorsDan Farmer, Thomas E. Rowley, Mark Andrews
Life of this patent
Estimating the term…
Abstract
An improved mechanism is provided for storage, recovery, and analysis of network traffic data, without requiring prohibitive amounts of storage space. Network traffic data is recorded in a sliding buffer. In normal operation, after some period of time, the oldest data in the buffer is deleted, yielding more storage space for more recent data. In response to a trigger event, such as any detected problem, attack, or similar incident, relevant pre-event and post-event data is retained for analysis.
Claims54
A computer-implemented method for buffering and selectively retaining data in an electronic device, comprising:
- receiving a stream of time-based data, comprising a plurality of data items having time stamps;
- storing the received data items in a buffer;
- detecting at least one trigger event, the trigger event being associated with a trigger event time;
- for each detected trigger event, determining a retention period;
- retaining at least a subset of the stored data items corresponding to time stamps falling within at least one determined retention period;
- and
- storing the retained data in a storage device.
A non-transitory computer-readable medium for buffering and selectively retaining data in an electronic device, comprising instructions stored thereon, that when executed on a processor, perform the steps of:
- receiving a stream of time-based data, comprising a plurality of data items having time stamps;
- storing the received data items in a buffer;
- detecting at least one trigger event, the trigger event being associated with a trigger event time;
- for each detected trigger event, determining a retention period;
- retaining at least a subset of the stored data items corresponding to time stamps falling within at least one determined retention period;
- and
- storing the retained data in a storage device.
A system for buffering and selectively retaining data in an electronic device, comprising:
- a data monitor, configured to receive a stream of time-based data, comprising a plurality of data items having time stamps;
- a buffer, communicatively coupled to the data monitor, configured to store the received data items;
- an event detector, configured to detect at least one trigger event, the trigger event being associated with a trigger event time;
- a processor, communicatively coupled to the event detector, configured to:
- for each detected trigger event, determine a retention period;
- and
- designate for retention at least a subset of the stored data items corresponding to time stamps falling within at least one determined retention period;
- and
- a first data store, communicatively coupled to the processor and to the buffer, configured to store the data designated for retention.
Dependencies are inferred from the claim text.