System and method for data mining and security policy management

• US 8,205,242 B2
• Filed: 07/10/2008
• Issued: 06/19/2012
• Est. Priority Date: 07/10/2008
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Liu, Weimin
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/171,232
• Publication Number:
  US 20100011410A1
• Time in Patent Office: 1,440 Days
• Field of Search: 726/1, 726/11, 707/776
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method to generate and maintain controlled growth DAG are described. The controlled growth DAG conveys information about objects captured by a capture system.

Claims

1. A method comprising:

determining, by an electronic computing device, if a field of a tag describing an object captured by a capture system matches a prefix node in a controlled growth directed acyclic graph (DAG);

if the field matches a prefix node, updating at least one counter value of the matching prefix node;

if the field does not match a prefix node, creating a new node in the controlled growth DAG for the field and linking the new node;

determining if the field of the tag matches a suffix in the controlled growth DAG; and

if the field does match a suffix of the controlled growth DAG, removing the new node and updating at least one counter in the suffix node.

2. The method of claim 1, wherein the root node of the controlled growth DAG includes a global counter value representing the age of the controlled growth DAG and wherein each subsequent node of the controlled growth DAG includes a local age reflecting the number of changes made to a particular node and a current counter value and snapshot counter to reflect the two latest ages for that node.

3. The method of claim 2, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is equal to the global counter value, updating the current counter value of the node is updated.

4. The method of claim 3, further comprising:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is not equal to the global counter value,

replacing the prefix node'"'"'s snapshot counter value with the value of the current counter value,

updating the local age of the prefix node to be the value of the global counter value, and

updating the current counter value.

5. The method of claim 3, wherein the global counter value is increased when a snapshot of the capture system is created.

6. The method of claim 1, further comprising:

reordering at least one field of the tag.

7. The method of claim 1, further comprising:

receiving a tag to evaluate.

8. A non-transitory machine-readable storage medium including program code which, when executed by a processor, causes the processor to perform a method, the method comprising:

determining if a field of a tag describing an object captured by a capture system matches a prefix node in a controlled growth directed acyclic graph (DAG);

if the field matches a prefix node, updating at least one counter value of the matching prefix node;

if the field does not match a prefix node, creating a new node in the controlled growth DAG for the field and linking the new node;

determining if the field of the tag matches a suffix in the controlled growth DAG; and

if the field does match a suffix of the controlled growth DAG, removing the new node and updating at least one counter in the suffix node.

9. The non-transitory machine-readable storage medium of claim 8, wherein the root node of the controlled growth DAG includes a global counter value representing the age of the controlled growth DAG and wherein each subsequent node of the controlled growth DAG includes a local age reflecting the number of changes made to a particular node and a current counter value and snapshot counter to reflect the two latest ages for that node.

10. The non-transitory machine-readable storage medium of claim 9, wherein the method further comprises:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is equal to the global counter value, updating the current counter value of the node is updated.

11. The non-transitory machine-readable storage medium of claim 10, wherein the method further comprises:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is not equal to the global counter value,

replacing the prefix node'"'"'s snapshot counter value with the value of the current counter value,

updating the local age of the prefix node to be the value of the global counter value, and

updating the current counter value.

12. The non-transitory machine-readable storage medium of claim 10, wherein the global counter value is increased when a snapshot of the capture system is created.

13. The non-transitory machine-readable storage medium of claim 8, wherein the method further comprises:

reordering at least one field of the tag.

14. The non-transitory machine-readable storage medium of claim 8, wherein the method further comprises:

receiving a tag to evaluate.

15. An apparatus, comprising:

a memory for storing data; and

a processor operable to execute instructions associated with the data, wherein the apparatus is configured for;

determining if a field of a tag describing an object captured by a capture system matches a prefix node in a controlled growth DAG;

if the field matches a prefix node, updating at least one counter value of the matching prefix node;

if the field does not match a prefix node, creating a new node in the controlled growth DAG for the field and linking the new node;

determining if the field of the tag matches a suffix in the controlled growth DAG; and

if the field does match a suffix of the controlled growth DAG, removing the new node and updating at least one counter in the suffix node.

16. The apparatus of claim 15, wherein the root node of the controlled growth DAG includes a global counter value representing the age of the controlled growth DAG and wherein each subsequent node of the controlled growth DAG includes a local age reflecting the number of changes made to a particular node and a current counter value and snapshot counter to reflect the two latest ages for that node.

17. The apparatus of claim 16, further configured for:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is equal to the global counter value, updating the current counter value of the node is updated.

18. The apparatus of claim 17, further configured for:

determining if the prefix'"'"'s local age is equal to the global counter value of the root node, wherein if the prefix node'"'"'s local age is not equal to the global counter value,

replacing the prefix node'"'"'s snapshot counter value with the value of the current counter value,

updating the local age of the prefix node to be the value of the global counter value, and

updating the current counter value.

19. The apparatus of claim 17, wherein the global counter value is increased when a snapshot of the capture system is created.

20. The apparatus of claim 15, further configured for:

reordering at least one field of the tag.