INFERENCING DATA TYPES OF MESSAGE COMPONENTS

• US 20120216274A1
• Filed: 08/17/2011
• Published: 08/23/2012
• Est. Priority Date: 02/18/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Chauhan, Abhishek, Mirani, Rajiv, Kohli, Prince, Sikka, Namit
• Granted Patent: US 8,695,084 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method of a device for filtering messages routing across a network includes extracting, by a filter configured on the device, a plurality of message components from messages received via a network. The plurality of message components is identified as having at least a field name in common, including a first field name. A learning engine configured on the device creates a list of data types for values of the first field name. The list includes one or more data types of a value of the first field name identified for each of the plurality of message components. The learning engine determines a most restrictive data type from the list of data types for the values of the first field name of the plurality of message components.

Claims

1. A method of a device for generating a rule to filter messages routing across a network, the method comprising:

(a) identifying, by an engine executing on a device during a learning mode, a plurality of uniform resource locator (URL) components from URLs in messages received via a network, the plurality of URL components identified at a same hierarchical level within their corresponding URLs;

(b) selecting, by the engine, a most restrictive data type for the plurality of URL components identified at the same hierarchical level;

(c) determining, by a filter executing on the device during a filtering mode, if a URL component of a received message from the same hierarchical level matches the most restrictive data type; and

(d) allowing, by the filter, the received message to pass in response to a determination that the corresponding URL component matches the most restrictive data type selected.

2. The method of claim 1, further comprising generating, by the engine, a rule allowing messages with a URL component identified at the same hierarchical level having a data type that matches the most restrictive data type to pass.

3. The method of claim 2, further comprising applying the rule to the received message to determine whether to allow the received message to pass.

4. The method of claim 1, wherein identifying further comprises identifying the plurality of URL components from messages received via the network over a predefined duration.

5. The method of claim 1, wherein identifying further comprises identifying the plurality of URL components from a predefined number of messages received via the network.

6. The method of claim 1, further comprising maintaining, for each of a plurality of data types, a count of received messages with an identified URL component having the corresponding data type.

7. The method of claim 6, wherein determining further comprises:

determining that the number of identified URL components having a data type that matches a first data type exceeds a threshold, the first data type selected from the plurality of data types; and

selecting the first data type as the most restrictive data type.

8. The method of claim 7, wherein the threshold is based on a fraction of the plurality of identified URL components that should have a data type matching the most restrictive data type.

9. The method of claim 7, further comprising determining that a count of the identified URL components having a data type that matches a child data type does not exceed the threshold, wherein the identified URL components having a data type that matches the child data type is a subset of the URL components having a data type that matches the first data type.

10. The method of claim 6, further comprising representing the plurality of data types as nodes of a hierarchical graph, each node storing a count of the identified URL components having a data type that matches a data type corresponding to the node.

11. A device for generating a rule to filter messages routing across a network, the device comprising:

an engine executing on the device during a learning mode, identifying a plurality of uniform resource locator (URL) components at a same hierarchical level from URLs in messages received via a network, and selecting a most restrictive data type for the plurality of URL components identified at the same hierarchical level; and

a filter executing on the device during a filtering mode, determining if a URL component of a received message from the same hierarchical level matches the most restrictive data type, and allowing the received message to pass in response to a determination that the corresponding URL component matches the most restrictive data type selected.

12. The device of claim 11, wherein the engine generates a rule allowing messages with a URL component identified at the same hierarchical level having a data type that matches the most restrictive data type to pass.

13. The device of claim 12, wherein the filter applies the rule to the received message to determine whether to allow the received message to pass.

14. The device of claim 11, wherein the engine identifies the plurality of URL components from messages received via the network over a predefined duration.

15. The device of claim 11, wherein the engine identifies the plurality of URL components from a predefined number of messages received via the network.

16. The device of claim 11, wherein the engine maintains, for each of a plurality of data types, a count of received messages with an identified URL component having the corresponding data type.

17. The device of claim 16, wherein the engine determines that the number of identified URL components having a data type that matches a first data type selected from the plurality of data types exceeds a threshold, and selects the first data type as the most restrictive data type.

18. The device of claim 17, wherein the threshold is based on a fraction of the plurality of identified URL components that should have a data type matching the most restrictive data type.

19. The device of claim 17, wherein the engine determines that a count of the identified URL components having a data type that matches a child data type does not exceed the threshold, the identified URL components having a data type that matches the child data type is a subset of the URL components having a data type that matches the first data type.

20. The device of claim 16, wherein the engine represents the plurality of data types as nodes of a hierarchical graph, each node storing a count of the identified URL components having a data type that matches a data type corresponding to the node.