摘要:
A method for providing a compressed index for a stream of binary data records comprises steps of indexing a field from each record in a bitmap index, compressing stored bits in each column of the bitmap index by replacing a group of successive bits with a code and outputting the code. There is provided at least one of a first code for replacing a sequence of a first filling, a literal and a second filling, and a second code for replacing a sequence of a first literal, a filling and a second literal. In this context, a filling is a sequence of bits with the same value and a literal is a sequence of bits with different values.
摘要:
A method for providing a compressed index for a stream of binary data records comprises steps of indexing a field from each record in a bitmap index, compressing stored bits in each column of the bitmap index by replacing a group of successive bits with a code and outputting the code. There is provided at least one of a first code for replacing a sequence of a first filling, a literal and a second filling, and a second code for replacing a sequence of a first literal, a filling and a second literal. In this context, a filling is a sequence of bits with the same value and a literal is a sequence of bits with different values.
摘要:
Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising the source or destination IP addresses for the flow and one of: the other of the source or destination IP addresses; or direction data identifying the flow direction across the network boundary. A tree is generated representing IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with a node in common. Weights are assigned to nodes in the tree based on occurrences of the represented IP addresses in the flow data. The IP address range of the network is detected by identifying, based on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to differentiate IP addresses inside and outside the network.
摘要:
Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising one of the source and destination IP addresses for the flow and one of (a) the other of the source and destination IP addresses and (b) direction data indicative of the flow direction across the network boundary. A tree data structure is generated representing the IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with at least one node in common. Weights are assigned to nodes in the tree in dependence on occurrences of the represented IP addresses in at least a subset of the flow data. The IP address range of the network is then detected by identifying, in dependence on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to permit distinction between IP addresses inside and outside the network in operation of the device, e.g. for filtering or traffic classification.
摘要:
Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising the source or destination IP addresses for the flow and one of: the other of the source or destination IP addresses; or direction data identifying the flow direction across the network boundary. A tree is generated representing IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with a node in common. Weights are assigned to nodes in the tree based on occurrences of the represented IP addresses in the flow data. The IP address range of the network is detected by identifying, based on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to differentiate IP addresses inside and outside the network.
摘要:
Systems, methods, and computer program products for extracting port-level information of Web services with flow-based network monitoring. Exemplary embodiments include a method for extracting port-level information of Web services with flow-based network monitoring, the method including identifying a registry machine, coupling the registry machine to a traffic meter and flow monitor dynamically configuring the traffic meter, including exporting a first n bytes of a traffic payload exporting a sub-second traffic flow start and end times, extracting service provider information from traffic flow exports, including analyzing the exported n bytes of the traffic payload to extract port-level information at the flow monitor, extracting a value of an access point element, mapping a logical service provider address to a physical address and inserting the service into a Web Service Provider Registry within the flow meter, thereby populating the Web Service Provider Registry.
摘要:
Mechanisms are provided for automatic address range detection for an IP network. Flow data is obtained comprising one of the source and destination IP addresses for the flow and one of (a) the other of the source and destination IP addresses and (b) direction data indicative of the flow direction across the network boundary. A tree data structure is generated representing the IP addresses in the flow data. IP addresses with initial portions in common are represented in the tree with at least one node in common. Weights are assigned to nodes in the tree in dependence on occurrences of the represented IP addresses in at least a subset of the flow data. The IP address range of the network is then detected by identifying, in dependence on the assigned weights, the node associated with the last initial address portion common to all IP addresses in the network. A device is automatically configured with the IP address range to permit distinction between IP addresses inside and outside the network in operation of the device, e.g. for filtering or traffic classification.
摘要:
Systems, methods, and computer program products for extracting port-level information of Web services with flow-based network monitoring. Exemplary embodiments include a method for extracting port-level information of Web services with flow-based network monitoring, the method including identifying a registry machine, coupling the registry machine to a traffic meter and flow monitor dynamically configuring the traffic meter, including exporting a first n bytes of a traffic payload exporting a sub-second traffic flow start and end times, extracting service provider information from traffic flow exports, including analyzing the exported n bytes of the traffic payload to extract port-level information at the flow monitor, extracting a value of an access point element, mapping a logical service provider address to a physical address and inserting the service into a Web Service Provider Registry within the flow meter, thereby populating the Web Service Provider Registry.
摘要:
Network flow records from various administrative domains are provided to a network monitoring entity. The network monitoring entity analyzes the network flow records in a way to locate a source of malicious network flow.
摘要:
A method for configuring network device adapted to process network traffic comprising a plurality of network flows and to export network flow information. For configuring the network device, a copy of the network traffic that is processed by the network device is created. A simulation of a process of collecting the network flow information using the copy of the network traffic is performed. Based on the results of the simulation, a preferred information collection scheme is determined. The network device is then configured to collect the network flow information to be exported according to the preferred information collection scheme.