Database for a capture system

• US 20060041570A1
• Filed: 01/06/2005
• Published: 02/23/2006
• Est. Priority Date: 08/23/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Broeker, Stephen, Lowe, Rick
• Granted Patent: US 7,483,916 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure
• CPC Class Codes: Y10S 707/99947 Object-oriented database structure reference

Abstract

A tag database storing tags indexing captured object can be searched efficiently. In one embodiment, such a search begins by receiving a query for one or more objects captured by a capture system, and determining whether a query time range exceeds a time range of a set of fast tables. In one embodiment, the invention further includes searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects. In one embodiment, the invention further includes searching a set of hourly tables if the query time range does exceed the time range of the fast tables. In one embodiment, the present invention further includes searching a set of daily tables if the query time range also exceeds the time range of the hourly tables.

Claims

1. A tag database comprising:

a first set of tables having a first granularity and including a first input table for receiving tags into the database; and

a second set of tables having a second granularity and including a second input table for receiving tags into the database, wherein the first granularity is finer than the second granularity.

2. The tag database of claim 1, further including a third set of tables having a third granularity and including a third input table for receiving tags into the database wherein the second granularity is finer than the third granularity.

3. The tag database of claim 2, wherein the first granularity comprises 5-minute time windows, the second granularity comprises one-hour time windows, and the third granularity comprises one-day time windows.

4. The tag database of claim 1, wherein the tags contain meta-data related captured objects.

5. The tag database of claim 1, wherein the first set of tables cascades as the first input table becomes full.

6. The tag database of claim 5, wherein the first set of tables cascades by dropping the last table, renaming all remaining tables, and creating a new input table.

7. The tag database of claim 1, wherein the first set of tables is stored in a memory of a device and the second set of tables is stored in a disk of a device.

8. A method comprising:

inserting a tag into a first input table, a second input table, and a third input table simultaneously, the first, second, and third input tables corresponding with a first, second, and third set of cascading tables respectively; and

upon the filling of the first input table, dropping the last table of the first set of cascading tables, designating the first input table as a read-only table, and creating a new input table for the first set of cascading tables.

9. The method of claim 8, further comprising upon the filling of the second input table, dropping the last table of the second set of cascading tables, designating the second input table as a read-only table, and creating another new input table for the second set of cascading tables.

10. The method of claim 8, wherein each table in the first set of tables contains tags associated with objects captured within 5 minutes of one another.

11. The method of claim 8, wherein each table in the second set of tables contains tags associated with objects captured within one hour of one another.

12. A method comprising:

receiving a query for one or more objects captured by a capture system;

determining whether a query time range exceeds a time range of a set of fast tables; and

searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects.

13. The method of claim 12, further comprising searching a set of hourly tables if the query time range does exceed the time range of the fast tables.

14. The method of claim 13, further comprising searching a set of daily tables if the query time range also exceeds the time range of the hourly tables.

15. The method of claim 14, wherein the fast tables have a finer granularity than the hourly tables, and the hourly tables have a finer granularity than the daily tables.

16. The method of claim 14, wherein searching the set of fast tables comprises accessing the set of fast tables stored in memory, and wherein searching the set of hourly and daily tables comprises accessing the set of hourly tables and daily tables on a disk.

17. A method comprising:

capturing an object being transmitted over a network;

generating a tag associated with the captured object, the tag containing metadata related to the captured object;

inserting the tag into a first table of a first set of cascading tables, the first set of cascading tables containing tags generated within a first timeframe; and

inserting the tag into second table of a second set of cascading tables, the second set of cascading tables, the second set of cascading tables being larger than the first set of cascading tables and containing tags generated within a second timeframe, the second timeframe being longer than the first timeframe.

18. The method of claim 17, further comprising receiving a query for the tag;

determining whether the tag exceeds the first timeframe; and

searching for the tag in one of the first set of cascading tables if the tag does not exceed the first timeframe.

19. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

inserting a tag into a first input table, a second input table, and a third input table simultaneously, the first, second, and third input tables corresponding with a first, second, and third set of cascading tables respectively; and

upon the filling of the first input table, dropping the last table of the first set of cascading tables, designating the first input table as a read-only table, and creating a new input table for the first set of cascading tables.

20. The machine-readable medium of claim 19, wherein the instructions further cause the processor to, upon the filling of the second input table, drop the last table of the second set of cascading tables, designating the second input table as a read-only table, and creating another new input table for the second set of cascading tables.

21. The machine-readable medium of claim 19, wherein each table in the first set of tables contains tags associated with objects captured within 5 minutes of one another.

22. The machine-readable medium of claim 19, wherein each table in the second set of tables contains tags associated with objects captured within one hour of one another.

23. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a query for one or more objects captured by a capture system;

determining whether a query time range exceeds a time range of a set of fast tables; and

searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects.

24. The machine-readable medium of claim 23, wherein the instructions further cause the processor to search a set of hourly tables if the query time range does exceed the time range of the fast tables.

25. The machine-readable medium of claim 24, wherein the instruction further cause the processor to search a set of daily tables if the query time range also exceeds the time range of the hourly tables.

26. The machine-readable medium of claim 25, wherein the fast tables have a finer granularity than the hourly tables, and the hourly tables have a finer granularity than the daily tables.

27. The machine-readable medium of claim 25, wherein searching the set of fast tables comprises accessing the set of fast tables stored in memory, and wherein searching the set of hourly and daily tables comprises accessing the set of hourly tables and daily tables on a disk.