Efficient classification of network packets

A system for classifying a data packet, comprising:

• means for receiving a data packet destined for a recipient, the received packet comprising a plurality of included features;
• means for describing the data packet as a feature vector, the feature vector comprising at least one feature that is algorithmically-generated at the system based on one or more of the plurality of included features or from previously received packets, wherein the at least one algorithmically-generated feature is represented by an undefined value that is an element of a range of the at least one algorithmically-generated feature, the undefined value indicating that at least one optional field is not present in the received packet;
• and
• means for corresponding the feature vector to a feature space employing one or more spatial access methods to classify the feature vector according to one or more classification rules, wherein the one or more spatial access methods have a non-linear complexity with respect to a number of the one or more classification rules, and wherein the one or more spatial access methods include one or more of an R-tree, an R+-tree, or an R*-tree whose leaf minimum-bounding rectangles are isomorphic with the one or more classification rules.

A processor that executes instructions embodied on a non-transitory computer-readable medium for applying packet matching, the instructions configured for:

• constructing a spatial index;
• inserting prisms into the spatial index;
• receiving one or more packets, each packet comprising a plurality of included features;
• describing the one or more packets as feature vectors, a feature vector comprising at least one feature that is algorithmically-generated by the processor based on one or more of the plurality of included features or from previously received packets, wherein the at least one algorithmically-generated feature is represented by an undefined value that is an element of a range of the at least one algorithmically-generated feature, the undefined value indicating that at least one optional field is not present in the received packet;
• and
• matching feature vectors against prisms by employing one or more spatial access methods to classify the feature vectors according to one or more classification rules, wherein the one or more spatial access methods have a non-linear complexity with respect to a number of the one or more classification rules, and by performing feature queries on the spatial index, and wherein the one or more spatial access methods include one or more of an R-tree, an R+-tree, or an R*-tree whose leaf minimum-bounding rectangles are isomorphic with the one or more classification rules.

A computer program product configured for classifying a packet, comprising:

• a non-transitory computer-readable medium comprising:
• a first set of codes for causing a computer to receive a packet destined for a recipient, the received packet comprising a plurality of included features;
• a second set of codes for causing the computer to describe the packet as a feature vector, the feature vector comprising at least one feature that is an algorithmically-generated by the computer based on one or more of the plurality of included features or from previously received packet, wherein the at least one algorithmically-generated feature is represented by an undefined value that is an element of a range of the at least one algorithmically-generated feature, the undefined value indicating that at least one optional field is not present in the received packet;
• and
• a third set of codes for causing the computer to map the feature vector to a feature space by employing one or more spatial access methods to classify the feature vector according to one or more classification rules, wherein the one or more spatial access methods have a non-linear complexity with respect to a number of the one or more classification rules, and wherein the one or more spatial access methods include one or more of an R-tree, an R+-tree, or an R*-tree whose leaf minimum-bounding rectangles are isomorphic with the one or more classification rules.