Method, system, and computer program product for identifying common factors associated with network activity with reduced resource utilization

• US 8,838,774 B2
• Filed: 08/21/2007
• Issued: 09/16/2014
• Est. Priority Date: 08/21/2007
• Status: Active Grant

• Current Assignee: InMon Corp.
• Original Assignee: InMon Corp.
• Inventors: Phaal, Peter, McKee, Neil
• Primary Examiner(s): WILLIAMS, JENEE LAUREN
• Application Number:
  US11/842,850
• Publication Number:
  US 20090055420A1
• Time in Patent Office: 2,583 Days
• Field of Search: 709201-203, 709217-219, 709223-229, 707101-1041
• US Class Current: 709/224
• CPC Class Codes: H04L 43/02 Capturing of monitoring data

Abstract

Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Claims

1. A computer implemented method for analyzing network traffic, the method comprising:

identifying a first factor associated with each of a plurality of records by extracting attributes disposed in packets transmitted across the network, said packets comprising the plurality of records;

storing a plurality of first values associated with the first factor in a data structure in a tangible medium accessible to the computer;

determining a median of either the plurality of the first values or a subset of the plurality of the first values using a hash table; and

pruning, using the computer, only the plurality of records whose plurality of first values are less than or equal to the median.

2. The computer implemented method of claim 1 further comprising:

storing the plurality of first values in the hash table; and

computing the median using data stored in first entries of the hash table.

3. The computer implemented method of claim 1, in which at least one of the plurality of records comprises a network usage record reflecting the network traffic, wherein the network usage record comprises a plurality of attributes.

4. The computer implemented method of claim 1, further comprising:

identifying a second factor associated with the plurality of records.

5. The computer implemented method of claim 4, further comprising:

storing in a non-transitory tangible medium a plurality of second values associated with a second factor identified in the plurality of records, said non-transitory tangible medium being accessible to the computer;

determining a second median of either the plurality of the second values or a subset of the plurality of the second values using the computer; and

pruning, using the computer, the plurality of records whose plurality of second values are less than or equal to the second median.

6. The computer implemented method of claim 5, wherein the pruning comprises pruning all the plurality of records whose plurality of second values are less than or equal to a threshold for excessive network activities.

7. The computer implemented method of claim 5, wherein a second value of the plurality of second values represents aggregated network activity.

8. The computer implemented method of claim 1, in which the first factor associated with at least one of the plurality of records is extracted from information transmitted across the network.

9. The computer implemented method of claim 1, in which the data structure is associated with a database or an associative array comprising a hash table or a binary tree.

10. The computer implemented method of claim 1, wherein at least one of the plurality of first values represents an amount of network traffic attributable to an associated first factor for an associated first record.

11. The computer implemented method of claim 1, wherein the pruning comprises pruning all the plurality of records whose plurality of first values are less than or equal to a threshold for excessive network activities.

12. The computer implemented method of claim 1, wherein a first value of the plurality of first values represents aggregated network activity.

13. A non-transitory computer readable storage medium comprising instructions that when executed by a processor disposed in the computer causes the processor to:

identify a first factor associated with each of a plurality of records by extracting attributes disposed in packets transmitted across the network, said packets comprising the plurality of records;

store a plurality of first values associated with the first factor in a data structure in a non-transitory tangible medium accessible to the computer;

determine a median of either the plurality of the first values or of a subset of the plurality of the first values using a hash table; and

prune only the plurality of records whose plurality of first values are less than or equal to the median.

14. The non-transitory computer readable storage medium of claim 13 wherein the non-transitory computer readable storage medium further comprises instructions that when executed by the processor causes the processor to:

store the plurality of first values in the hash table; and

compute the median using data stored in first entries of the hash table.

15. The non-transitory computer readable storage medium of claim 13, wherein the non-transitory computer readable storage medium further comprises instructions that when executed by the processor causes the processor to:

identify a second factor associated with the plurality of records.

16. The non-transitory computer readable storage medium of claim 13, wherein the pruning comprises pruning all the plurality of records whose plurality of first values are less than or equal to a threshold for excessive network activities.

17. The non-transitory computer readable storage medium of claim 13, wherein the first value of the plurality of first values represents aggregated network activity.