Back to results
US 8,510,830 B2Granted
Method and apparatus for efficient netflow data analysis
AssigneeFluke Corporation
InventorPeter Reilly
Life of this patent
Estimating the term…
Abstract
A flow based detection system for detecting networks attacks on data networks. Flow records are collected in a novel data structure that facilitates efficient sorting. The sorted data structure can be subsequently analyzed in an efficient manner to find out if the network is under attack. An attack is identified if the numbers of unique corresponding addresses or conversations are too large.
Claims13
An apparatus for collecting netflow data comprising:
- a processor adapted to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed operable to:
- receive, via the apparatus, a plurality of flow records from at least one network device, each flow record having at least a source Internet Protocol (IP) address and a destination IP address;
- extract, via the apparatus, data from the received flow records into a block data structure, wherein the block data structure includes a plurality of individual elements each storing extracted data including the source IP address and the destination IP address from a respective flow record, and an index of each of the plurality of individual elements;
- sort, via the apparatus, the individual elements in the block data structure by re-ordering the index of each of the plurality of individual elements;
- and
- process, via the apparatus, the block data structure as a data stream according to the stored individual elements to identify a pattern of network usage based on a number of flow records indicating at least a same IP address or destination IP address.
5 more elements
A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to:
- receive a plurality of flow records from at least one network device, each flow record having at least a source Internet Protocol (IP) address and a destination IP address;
- extract data from the received flow records into a block data structure, wherein the block data structure includes a plurality of individual elements each storing extracted data including the source IP address and the destination IP address from a respective flow record and an index of each of the plurality of individual elements;
- sort the individual elements in the block data structure by re-ordering the index of each of the plurality of individual elements;
- and
- process the block data structure as a data stream according to the sorted individual elements to identity a pattern of network usage based on a number of flow records indicating at least a same source IP address or destination IP address.
2 more elements
Dependencies are inferred from the claim text.