US 9,143,393 B1Granted

System, method and apparatus for classifying digital data

AssigneeRed Lambda, Inc.

InventorsRobert Bird, Greg Barton, Matthew Whitlock

Life of this patent

Estimating the term…

Loading patent…

Abstract

A data classification system comprising a server adapted to receive data elements from a computer network, compute a distance between the elements and a plurality of representative elements such that where the distance is less than a threshold, the input elements are associated with the representative element and where the distance is not less than the threshold, the input element is stored as a new representative element. A method of classifying network traffic is further disclosed that can include providing a server adapted to receive data from a network, compute a distance between the data elements and representative data elements such that where the distance is less than a threshold, the input elements are associated with the representative element and where the distance is not less than the threshold, the input element is stored as a new representative element.

Claims51

Dependent claims

An incrementally learning data classification system comprising at least one specially-programmed server comprising a processor and at least one machine-readable storage, said server being operably connected to a computer network, wherein said processor is adapted to:

a. receive input data elements from said computer network;
b. compute a normalized compression distance between said input data elements and a plurality of representative data elements stored in said machine-readable storage and compare said input data elements to said representative data elements based on a threshold value such that
(i) where the normalized compression distance between one of said representative data elements and said input data element is less than said threshold value, said processor executes a predetermined set of instructions corresponding to said representative data element, and
(ii) where the normalized compression distance between said input data element and all said representative data elements is not less than said threshold value said processor stores said input data element in said at least one machine-readable storage as a new representative data element, and
c. said processor is further adapted to output associations of said input data elements and said representative data elements based on said normalized compression distance being less than said threshold value wherein said associations represent categorizations of said input data elements and said representative data elements based on common properties;
whereby said input data elements are classified based on said associations output by said processor.

3 more elements

An incrementally learning data processing system for classifying data elements comprising:

a. at least one computer processor means for processing data, said computer processor means being operably connected to a computer network;
b. at least one storage means for storing data available for processing by said at least one computer processor means on a machine readable medium;
c. at least one first means for receiving input data elements from said computer network;
d. at least one second means for computing a normalized compression distance between said input data elements and a plurality of representative data elements stored in said at least one storage means and comparing said input data elements to said representative data elements based on a threshold value such that
(i) where the normalized compression distance between one of said representative data elements and said input data element is less than said threshold value, said second means causes a predetermined set of instructions corresponding to said representative data element to be performed, and
(ii) where the normalized compression distance between said input data element and said representative data elements is not less than said threshold value said second means stores said input data element in said at least one machine-readable storage as a new representative data element,
whereby performance of said set of instructions corresponding to said representative data element classifies said input data element as being associated with said representative data element.

4 more elements

A method of classifying network traffic comprising:

a. providing at least one specially-programmed server comprising a processor and at least one machine-readable storage, said specially-programmed server being operably connected to a computer network,
b. causing said at least one specially-programmed server to
(i) receive input data elements from network traffic on said computer network;
(ii) compute a normalized compression distance between said input data elements and a plurality of representative data elements stored in said machine-readable storage and compare said input data elements to said representative data elements based on a threshold value such that
where the normalized compression distance between one of said representative data elements and said input data element is less than said threshold value, said processor associating said input data element with said representative data element, and
where the normalized compression distance between said input data element and all said representative data elements is not less than said threshold value said processor stores said input data element in said at least one machine-readable storage as a new representative data element, and
c. outputting associations of said input data elements and said representative data elements based on said normalized compression distance being less than said threshold value wherein said associations represent categorizations of said input data elements based on common properties;
whereby said network traffic is classified based on said output associations such that traffic associated with each said representative data element is grouped according the same classification.

5 more elements

(a) receive input data elements from said computer network;
(b) compute a plurality of metrics for each said input data element;
(c) compute a Manhattan distance based on said plurality of metrics between said input data elements and a plurality of representative data elements stored in said machine-readable storage and compare said input data elements to said representative data elements based on a threshold value such that
(i) where the distance between one of said representative data elements and said input data element is less than said threshold value, said processor executes a predetermined set of instructions corresponding to said representative data element, and
(ii) where the distance between said input data element and all said representative data elements is not less than said threshold value, said processor stores said input data element in said at least one machine-readable storage as a new representative data element and forms an association between said new representative data element and at least one closest stored representative data element;
and
(c) said processor is further adapted to output associations of said input data elements and said representative data elements based on said distance being less than said threshold value wherein said associations represent categorizations of said input data elements and said representative data elements based on common properties;
whereby said input data elements are classified based on said associations output by said processor.

5 more elements

An incrementally learning data processing system for classifying data elements comprising:

(a) at least one computer processor means for processing data, said computer processor means being operably connected to a computer network;
(b) at least one storage means for storing data available for processing by said at least one processor on a machine readable medium;
(c) at least one first means for receiving input data elements from said computer network and computing a plurality of metrics from said input data elements;
(d) at least one second means for computing a Manhattan distance based on said metrics between said input data elements and a plurality of representative data elements stored in said at least one storage means and comparing said input data elements to said representative data elements based on a threshold value such that
(i) where the distance between one of said representative data elements and said input data element is less than said threshold value, said second means causes a predetermined set of instructions corresponding to said representative data element to be performed, and
(ii) where the distance between said input data element and said representative data elements is not less than said threshold value said second means stores said input data element in said at least one machine-readable storage as a new representative data element and stores an association between said new representative data element and at least one closest stored representative data element,
whereby performance of said set of instructions corresponding to said representative data element classifies said input data element as being associated with said representative data element.

4 more elements

A method of classifying network traffic comprising:

(a) providing at least one specially-programmed server comprising a processor and at least one machine-readable storage, said at least one specially-programmed server being operably connected to a computer network;
(b) causing said at least one specially-programmed server to
(i) receive input data elements from network traffic on said computer network and calculate a plurality of metrics from each said input data element,
(ii) compute a Manhattan distance based on said metrics between said input data elements and a plurality of representative data elements stored in said machine-readable storage and compare said input data elements to said representative data elements based on a threshold value such that
where the distance between one of said representative data elements and said input data element is less than said threshold value, said processor associates said input data element with said representative data element, and
where the distance between said input data element and all said representative data elements is not less than said threshold value said processor stores said input data element in said at least one machine-readable storage as a new representative data element and stores at least one association between said new representative data element and the closest said stored data representative data element;
and
(c) further causing said at least one specially-programmed server to output associations of said input data elements and said representative data elements based on said compression distance being less than said threshold value wherein said associations represent categorizations of said input data elements based on common properties;
whereby said network traffic is classified based on said output associations such that traffic associated with each said representative data element is grouped according the same classification.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/351,780Filed 17 Jan 2012 · continuation in part
Priority: 25 May 2004
Granted: 22 Sep 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

G16B 50/50
ICT programming tools or database systems specially adapted for bioinformatics: compression of genetic data
G06F 18/21355
Based on approximation criteria, e.g. principal component analysis: nonlinear criteria, e.g. embedding a manifold in a Euclidean space
G06N 3/043
Architecture, e.g. interconnection topology: based on fuzzy logic, fuzzy membership or fuzzy inference, e.g. adaptive neuro-fuzzy inference…
H04L 41/046
Network management architectures or arrangements: comprising network management agents or mobile agents therefor

Family

Application10/852,776Parent of this continuation-in-part · filed 25 May 2004
Application61/432,795Us provisional application · filed 14 Jan 2011
Application61/489,535Us provisional application · filed 24 May 2011
Application61/567,408Us provisional application · filed 6 Dec 2011
US 2006/0031463 A1Published application
US 9,210,036 B2Related patent
US 9,143,393 B1This patent

From the US filing history. Foreign family members aren’t listed.