SYSTEM AND METHOD FOR DATA MINING AND SECURITY POLICY MANAGEMENT

• US 20100011410A1
• Filed: 07/10/2008
• Published: 01/14/2010
• Est. Priority Date: 07/10/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Liu, Weimin
• Granted Patent: US 8,205,242 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method to generate and maintain controlled growth DAG are described. The controlled growth DAG conveys information about objects captured by a capture system.

Claims

1. A method comprising:

determining if a field of a tag describing an object captured by a capture system matches a prefix node in a controlled growth directed acyclic graph (DAG);

if the field matches a prefix node, updating at least one counter value of the matching prefix node;

if the field does not match a prefix node, creating a new node in the controlled growth DAG for the field and linking the new node;

determining if the field of the tag matches a suffix in the controlled growth DAG; and

if the field does match a suffix of the controlled growth DAG, removing the new node and updating at least one counter in the suffix node.

2. The method of claim 1, wherein the root node of the controlled growth DAG includes a global counter value representing the age of the controlled growth DAG and wherein each subsequent node of the controlled growth DAG includes a local age reflecting the number of changes made to a particular node and a current counter value and snapshot counter to reflect the two latest ages for that node.

3. The method of claim 2, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is equal to the global counter value, updating the current counter value of the node is updated.

4. The method of claim 3, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is not equal to the global counter value,

replacing the prefix node'"'"'s snapshot counter value with the value of the current counter value,

updating the local age of the prefix node to be the value of the global counter value, and

updating the current counter value.

5. The method of claim 3, wherein the global counter value is increased when a snapshot of the capture system is created.

6. The method of claim 1, further comprising:

reordering at least one field of the tag.

7. The method of claim 1, further comprising:

receiving a tag to evaluate.

8. A machine-readable storage medium including program code which, when executed by a processor, causes the processor to perform a method, the method comprising:

determining if a field of a tag describing an object captured by a capture system matches a prefix node in a controlled growth directed acyclic graph (DAG);

if the field matches a prefix node, updating at least one counter value of the matching prefix node;

if the field does not match a prefix node, creating a new node in the controlled growth DAG for the field and linking the new node;

determining if the field of the tag matches a suffix in the controlled growth DAG; and

if the field does match a suffix of the controlled growth DAG, removing the new node and updating at least one counter in the suffix node.

9. The method of claim 8, wherein the root node of the controlled growth DAG includes a global counter value representing the age of the controlled growth DAG and wherein each subsequent node of the controlled growth DAG includes a local age reflecting the number of changes made to a particular node and a current counter value and snapshot counter to reflect the two latest ages for that node.

10. The method of claim 9, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is equal to the global counter value, updating the current counter value of the node is updated.

11. The method of claim 10, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is not equal to the global counter value,

replacing the prefix node'"'"'s snapshot counter value with the value of the current counter value,

updating the local age of the prefix node to be the value of the global counter value, and

updating the current counter value.

12. The method of claim 10, wherein the global counter value is increased when a snapshot of the capture system is created.

13. The method of claim 8, further comprising:

reordering at least one field of the tag.

14. The method of claim 8, further comprising:

receiving a tag to evaluate.