Database for a capture system

• US 7,483,916 B2
• Filed: 01/06/2005
• Issued: 01/27/2009
• Est. Priority Date: 08/23/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Broeker, Stephen, Lowe, Rick
• Primary Examiner(s): Vy; Hung T
• Application Number:
  US11/031,582
• Publication Number:
  US 20060041570A1
• Time in Patent Office: 1,482 Days
• Field of Search: 707/2, 707/3, 707/100, 707/101, 707/103.R, 707/103.Z, 707/130.Z, 709/203
• US Class Current: 1/1
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure
• CPC Class Codes: Y10S 707/99947 Object-oriented database structure reference

Abstract

A tag database storing tags indexing captured object can be searched efficiently. In one embodiment, such a search begins by receiving a query for one or more objects captured by a capture system, and determining whether a query time range exceeds a time range of a set of fast tables. In one embodiment, the invention further includes searching the set of fast tables if the query time range does not exceed the time range of the fast tables, the set of fast tables containing tags having meta-data related to captured objects. In one embodiment, the invention further includes searching a set of hourly tables if the query time range does exceed the time range of the fast tables. In one embodiment, the present invention further includes searching a set of daily tables if the query time range also exceeds the time range of the hourly tables.

Claims

1. A computer implemented method comprising:

inserting a tag into a first input table, a second input table, and a third input table simultaneously, the first, second, and third input tables corresponding with a first, second, and third set of cascading tables respectively, wherein

the tag indexes a captured object in storage and contains information about the captured object,

the first set of cascading tables have a first granularity, the second set of cascading tables have a second granularity, the third set of cascading tables have a third granularity, the first granularity is finer than the second granularity, and the second granularity is finer than the third granularity; and

upon the filling of the first input table, dropping the last table of the first set of cascading tables, designating the first input table as a read-only table, and creating a new input table for the first set of cascading tables.

2. The computer implemented method of claim 1, further comprising upon the filling of the second input table, dropping the last table of the second set of cascading tables, designating the second input table as a read-only table, and creating another new input table for the second set of cascading tables.

3. The computer implemented method of claim 1, wherein the granularity for each table in the first set of tables comprises tags associated with objects captured within 5 minutes of one another.

4. The computer implemented method of claim 1, wherein each table in the second set of tables comprises tags associated with objects captured within one hour of one another.

5. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:

inserting a tag into a first input table, a second input table, and a third input table simultaneously, the first, second, and third input tables corresponding with a first, second, and third set of cascading tables respectively, wherein

the tag indexes a captured object in storage and contains information about the captured object,

the first set of cascading tables have a first granularity, the second set of cascading tables have a second granularity, the third set of cascading tables have a third granularity, the first granularity is finer than the second granularity, and the second granularity is finer than the third granularity; and

upon the filling of the first input table, dropping the last table of the first set of cascading tables, designating the first input table as a read-only table, and creating a new input table for the first set of cascading tables.

6. The machine-readable medium of claim 5, wherein the instructions further cause the processor to, upon the filling of the second input table, drop the last table of the second set of cascading tables, designating the second input table as a read-only table, and creating another new input table for the second set of cascading tables.

7. The machine-readable medium of claim 5, wherein the granularity for each table in the first set of tables comprises tags associated with objects captured within 5 minutes of one another.

8. The machine-readable medium of claim 5, wherein the granularity for each table in the second set of tables comprises tags associated with objects captured within one hour of one another.