System and method for managing files in a distributed system using prioritization

• US 6,560,632 B1
• Filed: 07/16/1999
• Issued: 05/06/2003
• Est. Priority Date: 07/16/1999
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Chess, David Michael, Kephart, Jeffrey Owen, Morar, John Frederick, Pring, Edward John, White, Steve Richard
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): NGUYEN, THU HA T
• Application Number:
  US09/356,183
• Time in Patent Office: 1,390 Days
• Field of Search: 709/201, 709/235, 709/206, 709/207, 709/234, 709/236, 709/232, 709/233, 709/229, 709/103, 709/240, 713/200, 713/201, 711/129, 382/113, 707/2, 345/418
• US Class Current: 709/201
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In a network-connected distributed system including nodes through which digital data flow, one or more of the nodes adapted to process the digital data, a method for efficiently managing the transmission of units of digital data from node to node includes the steps of receiving, at one of the one or more nodes, units of digital data first transmitted by an originating node; queuing, for processing at other nodes, one or more units of the digital data; prioritizing the queued units of digital data for transmission to a next node based on prioritizing information; and updating the prioritizing information according to results of processing performed in and received from the one of the one or more nodes and/or other nodes in the system.

Claims

1. In a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, a method for efficiently managing the transmission of units of digital data from node to node, the method comprising the steps of:

receiving, at one of the one or more nodes, one or more units of digital data first transmitted by an originating node;

queuing, for processing at other nodes, one or more units of the digital data;

prioritizing the queued units of digital data for transmission to a next node based on prioritizing information; and

updating the prioritizing information according to results of processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system,

where the units of digital data comprise queries or files, and wherein the prioritizing step comprises the steps of;

classifying the queued queries or files into categories,

clustering the files, in each of the categories, into similarity clusters;

choosing, for each similarity cluster, one or more representatives; and

determining an order of processing for the one or more representatives.

2. The method of claim 1 wherein the distributed system includes nodes for the reporting and analysis of incorrect or buggy software and the units of digital data comprise files.

3. The method of claim 1 wherein the distributed system comprises a system for the analysis of complex geographically-based such as satellite images and the units of digital data comprise requests for information about a particular geographical area.

4. The method of claim 1 wherein the distributed system comprises a system for the computation of integrals, and the units of digital data comprise queries of formulae to be integrated.

5. The method of claim 1 wherein the distributed system comprises a computer protection system and the units of digital data comprise files or checksums of files which are suspected to contain malicious code.

6. The method of claim 5 wherein the malicious code comprises at least one of computer viruses, worms or Trojan Horses.

7. The method of claim 1 wherein the classifying step includes the step of classifying the queued queries or files according to the type of digital object they contain.

8. The method of claim 1 wherein the distributed system comprises a computer protection system, the units of digital data comprise files which are suspected to contain malicious code and the clustering step includes the step of clustering the files in each category according to a code-similarity measure evaluated on a probably-malicious part of each file.

9. The method of claim 8 wherein the clustering step includes the step of using heuristics appropriate to each of the categories.

10. The method of claim 8 wherein the updating step comprises the steps of:

determining a file to be probably malicious;

identifying one or more other queued files as being in the same cluster as the file; and

adjusting the prioritizing information in response to the identifying step.

11. The method of claim 1 wherein the choosing step comprises the step of selecting N smallest files in each cluster as the one or more representatives, where N is an integer such as one.

12. The method of claim 1 wherein the determining step includes the step of ranking the one or more representatives so that representatives from clusters which contain more queued samples are to be transmitted prior to representatives from clusters which contain fewer queued samples.

13. The method of claim 1 wherein the updating step comprises the step of updating the prioritizing information according to results of automatic processing.

14. The method of claim 1 wherein the distributed system comprises a computer protection system and the units of digital data comprise samples of undesirable textual messages.

15. In a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, a method for efficiently managing the transmission of units of digital data from node to node, the method comprising the steps of:

receiving, at one of the one or more nodes, one or more units of digital data first transmitted by an originating node;

queuing, for processing at other nodes, one or more units of the digital data;

prioritizing the queued units of digital data for transmission to a next node based on prioritizing information; and

updating the prioritizing information according to results of processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system,

where the units of digital data comprise queries or files, and

wherein the units of digital data comprise queries including a database version of the originating node and a request for an updated version, if available, and wherein the updating step comprises the step of updating the originating prioritizing information of the originating node and/or other nodes of the system that are likely to have older versions.

16. The method of claim 15 wherein the database version corresponds to the prioritizing information.

17. In a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, a method for efficiently managing the transmission of units of digital data from node to node, the method comprising the steps of:

receiving, at one of the one or more nodes, units of digital data first transmitted by an originating node;

filtering out sufficiently processed units of the digital data based on filtering information;

transmitting, to at least one of the originating node and other nodes, filtered results relating to the sufficiently processed units;

queuing, for processing at other nodes, unfiltered units of the digital data which are not filtered out;

prioritizing the unfiltered units of digital data for transmission to a next node based on prioritizing information; and

updating the filtering information and the prioritizing information according to results of automatic processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system;

wherein the updating step comprises the step of re-executing at least one of the filtering step and the prioritizing step to apply the updated filtering and prioritizing information to the queued units of the digital data.

18. The method of claim 17 wherein the distributed system comprises a computer protection system, the units of digital data comprise samples of undesirable textual messages and the transmitting step includes the step of returning updated protection information to at least one of the originating node and other nodes.

19. The method of claim 17 wherein the distributed system includes nodes for the reporting and analysis of incorrect or buggy software, the units of digital data comprise files, and the transmitting step includes the step of returning updated information on bugs and fixes to at least one of the originating node and other nodes.

20. The method of claim 17 wherein the distributed system comprises a system for the analysis of complex geographically-based data such as satellite images, the units of digital data comprise requests for information about a particular geographical area, and the transmitting step includes the step of returning updated information on areas which have already been analyzed in response to prior queries to at least one of the originating node and other nodes.

21. The method of claim 17 wherein the distributed system comprises a system for the computation of integrals, and the units of digital data comprise queries of formulae to be integrated.

22. The method of claim 17 wherein the distributed system comprises a computer protection system and the units of digital data comprise files or checksums of files which are suspected to contain malicious code.

23. The method of claim 22 wherein the malicious code comprises at least one of computer viruses, worms or Trojan Horses.

24. A system for efficiently managing the transmission of units of digital data from node to node in a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, the system comprising:

means for receiving, at one of the one or more nodes, one or more units of digital data first transmitted by an originating node;

means for queuing, for processing at other nodes, one or more units of the digital data;

means for prioritizing the queued units of digital data for transmission to a next node based on prioritizing information; and

means for updating the prioritizing information according to results of processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system,

where the units of digital data comprise queries or files; and

wherein the prioritizing means comprise;

means for classifying the queued queries or files into categories,

means for clustering the files, in each of the categories, into similarity clusters;

means for choosing, for each similarity cluster, one or more representatives; and

means for determining an order of processing for the one or more representatives.

25. The system of claim 24 wherein the classifying means include means for classifying the queued queries or files according to the type of digital object they contain.

26. The system of claim 24 wherein the distributed system comprises a computer protection system, the units of digital data comprise files which are suspected to contain malicious code and the clustering means include means for clustering the files in each category according to a code-similarity measure evaluated on a probably-malicious part of each file.

27. The system of claim 26 wherein the clustering means include means for using heuristics appropriate to each of the categories.

28. The system of claim 26 wherein the updating means comprise:

means for determining a file to be probably malicious;

means for identifying one or more other queued files as being in the same cluster as the file; and

means for adjusting the prioritizing information in response to the identifying means.

29. The system of claim 24 wherein the choosing means comprise means for selecting N smallest files in each cluster as the one or more representatives, where N is an integer such as one.

30. The system of claim 24 wherein the determining means include means for ranking the one or more representatives so that representatives from clusters which contain more queued samples are to be transmitted prior to representatives from clusters which contain fewer queued samples.

31. A system for efficiently managing the transmission of units of digital data from node to node in a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, the system comprising:

means for receiving, at one of the one or more nodes, one or more units of digital data first transmitted by an originating node;

means for queuing, for processing at other nodes, one or more units of the digital data;

means for prioritizing the queued units of digital data for transmission to a next node based on prioritizing information; and

means for updating the prioritizing information according to results of processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system,

where the units of digital data comprise queries or files; and

wherein the units of digital data comprise queries including a database version of the originating node and a request for an updated version, if available, and wherein the updating means comprise means for updating the originating prioritizing information of at least one of the originating node and other nodes of the system that are likely to have older versions.

32. The system of claim 31 wherein the database version corresponds to the prioritizing information.

33. A system for efficiently managing the transmission of units of digital data from node to node in a network-connected distributed system comprising a plurality of nodes through which digital data flow, one or more of the nodes adapted to process the digital data, the system comprising:

means for receiving, at one of the one or more nodes, units of digital data first transmitted by an originating node;

means for filtering out sufficiently processed units of the digital data based on filtering information;

means for transmitting, to at least one of the originating node and other nodes, filtered results relating to the sufficiently processed units;

means for queuing, for processing at other nodes, unfiltered units of the digital data which are not filtered out;

means for prioritizing the unfiltered units of digital data for transmission to a next node based on prioritizing information; and

means for updating the filtering information and the prioritizing information according to results of automatic processing performed in and received from at least one of the one of the one or more nodes and other nodes in the system;

wherein the updating means comprise at least one of means for re-filtering and

means for re-prioritizing to apply the updated filtering and prioritizing information to the queued units of the digital data.