公开(公告)号：US08625642B2

公开(公告)日：2014-01-07

申请号：US12126551

申请日：2008-05-23

Applicant: Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

Inventor： Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

IPC: H04L12/66

CPC classification number: H04L67/36 ,  H04L51/12 ,  H04L63/0428

Abstract: A method, system, and apparatus of network artifact identification and extraction are disclosed. In one embodiment, a method includes aggregating a payload data (e.g., may be a component of the extracted artifact) from different network packets to form an aggregated payload data, matching the payload data with an entry of a library of known artifacts, determining a type of the payload data based on a match with the entry of the library of known artifacts, separating the payload data from a header data in a network packet, and communicating the aggregated payload data as an extracted artifact to a user. The method may include using the extracted artifact to perform network visibility analysis of users on packets flowing across the network. The method may validate that the entry is accurate by performing a deeper analysis of the payload data with the entry of the library of known artifacts.

Abstract translation: 公开了网络伪影识别和提取的方法，系统和装置。 在一个实施例中，一种方法包括从不同的网络分组聚合有效载荷数据（例如，可以是所提取的神器的组件）以形成聚合的有效载荷数据，将有效载荷数据与已知工件的库的条目相匹配， 基于与已知装置的库的条目的匹配的有效载荷数据的类型，将有效载荷数据与网络包中的标题数据分离，并将聚集的有效载荷数据作为提取的伪像传送给用户。 该方法可以包括使用所提取的伪影来对在网络上流动的分组上的用户执行网络可视性分析。 该方法可以通过使用已知工件的库的输入对有效载荷数据进行更深入的分析来验证该条目是否准确。

公开(公告)号：US20090292736A1

公开(公告)日：2009-11-26

申请号：US12126619

申请日：2008-05-23

Applicant: Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

Inventor： Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

IPC: G06F17/30

CPC classification number: H04L43/028

Abstract: A method, apparatus and a system of on demand network activity reporting through a dynamic file system and method are disclosed. In one embodiment, a method includes forming a root level selection guide based on a set of criteria associated with an activity through a network that is captured and stored on a storage device associated with a network appliance, refreshing listings of a sub-directory of the root level selection guide dynamically based on the activity through the network stored on the storage device when an option is selected in the root level selection guide, and creating a packet capture file based on a current state of the activity through the network when one of the listings of the sub-directory of the root level selection guide is selected. The method may include automatically referencing a database having the activity through the network when creating the packet capture file.

Abstract translation: 公开了一种通过动态文件系统和方法进行点播网络活动报告的方法，装置和系统。 在一个实施例中，一种方法包括：基于与通过网络的活动相关联的准则集合形成根级别选择指南，该网络捕获并存储在与网络设备相关联的存储设备上，刷新所述网络设备的子目录的列表 根层级选择指南，当在根级别选择指南中选择选项时，基于存储在存储设备上的网络的动态动态地创建根级别选择指南，以及当基于当前状态的网络中的一个时，基于活动的当前状态来创建分组捕获文件 选择根级别选择指南的子目录的列表。 该方法可以包括当创建分组捕获文件时自动引用具有通过网络的活动的数据库。

公开(公告)号：US20090290492A1

公开(公告)日：2009-11-26

申请号：US12126656

申请日：2008-05-23

Applicant: Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

Inventor： Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

IPC: G01R31/08

CPC classification number: H04L67/2804 ,  H04L43/026 ,  H04L43/18 ,  H04L63/1416 ,  H04L63/20 ,  H04L67/2842 ,  H04L69/22

Abstract: A method, system, and apparatus for indexing network traffic meta-data is disclosed. In one embodiment, a method includes identifying a packet having a header and a payload in a flow of a data through a network, classifying the header of the packet in a type of the header, determining an algorithm to extract a meta-data (e.g., which may be stored in a database of the storage device, and the storage device may be limited in a storage capacity) having information relevant to network traffic visibility based on the type of the header, extracting the meta-data from the header, and streaming the meta-data to a storage device. The method may include applying a last recently used algorithm to discard information from the storage device when storage device is limited in the storage capacity. The method may also include determining that the type of the header is an Ethernet header.

Abstract translation: 公开了一种用于索引网络流量元数据的方法，系统和装置。 在一个实施例中，一种方法包括通过网络在数据流中识别具有报头和有效载荷的分组，以标题的类型对分组的报头进行分类，确定提取元数据的算法（例如 ，其可以存储在存储设备的数据库中，并且存储设备可以被限制在存储容量中），其具有基于头部的类型的与网络流量可见性相关的信息，从头部提取元数据，以及 将元数据流传输到存储设备。 当存储设备在存储容量中被限制时，该方法可以包括应用最后最近使用的算法来从存储设备丢弃信息。 该方法还可以包括确定报头的类型是以太网报头。

公开(公告)号：US08849991B2

公开(公告)日：2014-09-30

申请号：US12968453

申请日：2010-12-15

Applicant: Joseph H. Levy ,  Matthew Scott Wood ,  Daniel Arnold ,  Kenny Foisy ,  Dave Tubbs

Inventor： Joseph H. Levy ,  Matthew Scott Wood ,  Daniel Arnold ,  Kenny Foisy ,  Dave Tubbs

IPC: G06F15/173 ,  H04L12/26 ,  G06F17/30

CPC classification number: G06F17/30902 ,  H04L43/18

Abstract: HTTP layered reconstruction is disclosed. A database is queried to identify a location of a previously reconstructed HTML artifact file or packet data of a HTML file in a repository that stores packet data captured from a network. The reconstructed HTML file is analyzed. Links to external files are identified and the database is queried to identify a location of previously reconstructed artifact files or packet data of associated external files. The external files are reconstructed, as needed. A web page is then reconstructed based on the reconstructed HTML file and reconstructed external files, presenting a view of the web page as it originally appeared to a user. A user may specify which external file types to include and/or not include. New versions of external files may be obtained and indicated in the reconstructed web page when associated artifact files or packet data are not stored within the repository.

Abstract translation: 公开了HTTP分层重建。 查询数据库以识别存储从网络捕获的分组数据的存储库中的先前重建的HTML工件文件或HTML文件的分组数据的位置。 分析重建的HTML文件。 识别与外部文件的链接，并查询数据库以识别先前重建的工件文件或相关外部文件的数据包数据的位置。 根据需要重构外部文件。 然后基于重构的HTML文件和重建的外部文件来重构网页，呈现网页最初对用户看来的视图。 用户可以指定要包括和/或不包括的外部文件类型。 当相关联的工件文件或分组数据不存储在存储库中时，可以在重建的网页中获得并指示新版本的外部文件。

公开(公告)号：US20090292681A1

公开(公告)日：2009-11-26

申请号：US12471433

申请日：2009-05-25

Applicant: MATTHEW SCOTT WOOD ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown ,  Joseph H. Levy ,  Daniel M. Arnold

Inventor： MATTHEW SCOTT WOOD ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown ,  Joseph H. Levy ,  Daniel M. Arnold

IPC: G06F17/30 ,  G06F3/048 ,  G06F7/00

CPC classification number: G06F7/00 ,  G06F17/30 ,  G06F17/30864 ,  H04L43/02 ,  H04L43/045

Abstract: A system and method of presentation of an extracted artifact based on an indexing technique are disclosed. In an embodiment, the method includes indexing a database of a captured network characteristic data using a processor and a memory to form an indexed capture data. The method includes enhancing a query response time with the indexed capture data. The method further includes searching the indexed capture data to generate a capture query result. The capture query result includes an extracted artifact. The method also includes graphically presenting the capture query result as at least one of an artifact list and an artifact image.

Abstract translation: 公开了一种基于索引技术呈现提取的伪影的系统和方法。 在一个实施例中，该方法包括使用处理器和存储器对捕获的网络特征数据的数据库进行索引以形成索引的捕获数据。 该方法包括使用索引的捕获数据增强查询响应时间。 该方法还包括搜索索引的捕获数据以产生捕获查询结果。 捕获查询结果包括提取的人工制品。 该方法还包括以图形方式呈现作为工件列表和工件图像中的至少一个的捕获查询结果。

公开(公告)号：US08004998B2

公开(公告)日：2011-08-23

申请号：US12471437

申请日：2009-05-25

Applicant: Joseph H Levy ,  Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

Inventor： Joseph H Levy ,  Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

IPC: H04L12/26 ,  G06F7/04

CPC classification number: H04L43/028 ,  H04L41/0213 ,  H04L49/70

Abstract: Methods and a system of capture and regeneration of a network data using a virtual software switch are disclosed. In an embodiment, a method includes capturing a network data using a virtual software switch, a processor, and a memory. The network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch. The method includes forming a stored network data in a memory. The method also includes regenerating the stored network data to form a reconstructed data.

Abstract translation: 公开了使用虚拟软件交换机捕获和再生网络数据的方法和系统。 在一个实施例中，一种方法包括使用虚拟软件交换机，处理器和存储器捕获网络数据。 捕获网络数据以执行网络可见性分析，并将网络数据传达到虚拟软件交换机的至少一个端口。 该方法包括在存储器中形成存储的网络数据。 该方法还包括重新生成存储的网络数据以形成重建的数据。

公开(公告)号：US20120158737A1

公开(公告)日：2012-06-21

申请号：US12968453

申请日：2010-12-15

Applicant: Joseph H. Levy ,  Matthew Scott Wood ,  Daniel Arnold ,  Kenny Foisy ,  Dave Tubbs

Inventor： Joseph H. Levy ,  Matthew Scott Wood ,  Daniel Arnold ,  Kenny Foisy ,  Dave Tubbs

IPC: G06F17/30

CPC classification number: G06F17/30902 ,  H04L43/18

Abstract: HTTP layered reconstruction is disclosed. A database is queried to identify a location of a previously reconstructed HTML artifact file or packet data of a HTML file in a repository that stores packet data captured from a network. The reconstructed HTML file is analyzed. Links to external files are identified and the database is queried to identify a location of previously reconstructed artifact files or packet data of associated external files. The external files are reconstructed, as needed. A web page is then reconstructed based on the reconstructed HTML file and reconstructed external files, presenting a view of the web page as it originally appeared to a user. A user may specify which external file types to include and/or not include. New versions of external files may be obtained and indicated in the reconstructed web page when associated artifact files or packet data are not stored within the repository.

Abstract translation: 公开了HTTP分层重建。 查询数据库以识别存储从网络捕获的分组数据的存储库中的先前重建的HTML工件文件或HTML文件的分组数据的位置。 分析重建的HTML文件。 识别与外部文件的链接，并查询数据库以识别先前重建的工件文件或相关外部文件的数据包数据的位置。 根据需要重构外部文件。 然后基于重构的HTML文件和重建的外部文件来重构网页，呈现网页最初对用户看来的视图。 用户可以指定要包括和/或不包括的外部文件类型。 当相关联的工件文件或分组数据不存储在存储库中时，可以在重建的网页中获得并指示新版本的外部文件。

公开(公告)号：US20130282760A1

公开(公告)日：2013-10-24

申请号：US13451503

申请日：2012-04-19

Applicant: Bhargav Madhav Pendse ,  Matthew Scott Wood ,  Neil Richard Terry

Inventor： Bhargav Madhav Pendse ,  Matthew Scott Wood ,  Neil Richard Terry

IPC: G06F17/30

CPC classification number: G06F16/21

Abstract: A method of sampling data in a database includes designating permanent read locations in a database. The database is populated with randomly loaded data. The permanent read locations in the database are sampled to form sampled repeatable results attributable to the permanent read locations and the randomly loaded data.

Abstract translation: 在数据库中采样数据的方法包括指定数据库中的永久读取位置。 数据库填充有随机加载的数据。 对数据库中的永久读取位置进行采样，以形成可归因于永久读取位置和随机加载数据的可重复取样结果。

公开(公告)号：US08521732B2

公开(公告)日：2013-08-27

申请号：US12471433

申请日：2009-05-25

Applicant: Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown ,  Joseph H Levy ,  Daniel M Arnold

Inventor： Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown ,  Joseph H Levy ,  Daniel M Arnold

IPC: G06F7/00 ,  G06F17/30

CPC classification number: G06F7/00 ,  G06F17/30 ,  G06F17/30864 ,  H04L43/02 ,  H04L43/045

Abstract: A system and method of presentation of an extracted artifact based on an indexing technique are disclosed. In an embodiment, the method includes indexing a database of a captured network characteristic data using a processor and a memory to form an indexed capture data. The method includes enhancing a query response time with the indexed capture data. The method further includes searching the indexed capture data to generate a capture query result. The capture query result includes an extracted artifact. The method also includes graphically presenting the capture query result as at least one of an artifact list and an artifact image.

Abstract translation: 公开了一种基于索引技术呈现提取的伪影的系统和方法。 在一个实施例中，该方法包括使用处理器和存储器对捕获的网络特征数据的数据库进行索引以形成索引的捕获数据。 该方法包括使用索引的捕获数据增强查询响应时间。 该方法还包括搜索索引的捕获数据以产生捕获查询结果。 捕获查询结果包括提取的人工制品。 该方法还包括以图形方式呈现作为工件列表和工件图像中的至少一个的捕获查询结果。

公开(公告)号：US20090290580A1

公开(公告)日：2009-11-26

申请号：US12126551

申请日：2008-05-23

Applicant: Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

Inventor： Matthew Scott Wood ,  Paal Tveit ,  Brian Edginton ,  Steve Shillingford ,  James Brown

IPC: H04L12/28

CPC classification number: H04L67/36 ,  H04L51/12 ,  H04L63/0428

Abstract: A method, system, and apparatus of network artifact identification and extraction are disclosed. In one embodiment, a method includes aggregating a payload data (e.g., may be a component of the extracted artifact) from different network packets to form an aggregated payload data, matching the payload data with an entry of a library of known artifacts, determining a type of the payload data based on a match with the entry of the library of known artifacts, separating the payload data from a header data in a network packet, and communicating the aggregated payload data as an extracted artifact to a user. The method may include using the extracted artifact to perform network visibility analysis of users on packets flowing across the network. The method may validate that the entry is accurate by performing a deeper analysis of the payload data with the entry of the library of known artifacts.

Abstract translation: 公开了网络伪影识别和提取的方法，系统和装置。 在一个实施例中，一种方法包括从不同的网络分组聚合有效载荷数据（例如，可以是所提取的神器的组件）以形成聚合的有效载荷数据，将有效载荷数据与已知工件的库的条目相匹配， 基于与已知装置的库的条目的匹配的有效载荷数据的类型，将有效载荷数据与网络包中的标题数据分离，并将聚集的有效载荷数据作为提取的伪像传送给用户。 该方法可以包括使用所提取的伪影来对在网络上流动的分组上的用户执行网络可视性分析。 该方法可以通过使用已知工件的库的输入对有效载荷数据进行更深入的分析来验证该条目是否准确。