Inferencing Data Types Of Message Components

• US 20100017869A1
• Filed: 09/29/2009
• Published: 01/21/2010
• Est. Priority Date: 02/18/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Chauhan, Abhishek, Mirani, Rajiv, Kohli, Prince, Sikka, Namit
• Granted Patent: US 8,011,009 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method of a device for filtering messages routing across a network includes extracting, by a filter configured on the device, a plurality of message components from messages received via a network. The plurality of message components is identified as having at least a field name in common, including a first field name. A learning engine configured on the device creates a list of data types for values of the first field name. The list includes one or more data types of a value of the first field name identified for each of the plurality of message components. The learning engine determines a most restrictive data type from the list of data types for the values of the first field name of the plurality of message components.

Claims

1. A method of a device for filtering messages routing across a network, the method comprising:

extracting, by a filter configured on a device, a plurality of message components from messages received via a network, the plurality of message components identified as having at least a field name in common, including a first field name;

creating, by a learning engine configured on the device, a list of data types for values of the first field name, the list comprising one or more data types of a value of the first field name identified for each of the plurality of message components; and

determining, by the learning engine, a most restrictive data type from the list of data types for the values of the first field name of the plurality of message components.

2. The method of claim 1, further comprising generating, by the learning engine, a rule allowing messages with a message component having a value of the first field name that matches the most restrictive data type to pass.

3. The method of claim 2, further comprising:

receiving a message via the network; and

applying the rule to determine whether to allow the message to pass.

4. The method of claim 1 wherein extracting further comprises extracting the plurality of message components from messages received via the network over a predefined duration.

5. The method of claim 1 wherein extracting further comprises extracting the plurality of message components from a predefined number of messages received via the network.

6. The method of claim 1, further comprising maintaining, for each data type from the list of data types, a count of messages with a message component having a value of the first field name that matches the data type.

7. The method of claim 1 wherein determining further comprises:

determining that the number of message components having a value of the first field name that matches a first data type exceeds a threshold, the first data type selected from the list of data types; and

assigning the first data type as the most restrictive data type.

8. The method of claim 7, wherein the threshold is based on a fraction of the plurality of message components that should have values of the field name that matches the most restrictive data type.

9. The method of claim 7, further comprising determining that a count of message components having values of the first field name that matches a child data type does not exceed the threshold, wherein the message components having values of the first field name that matches the child data type is a subset of the message components having values of the first field name that matches the first data type.

10. The method of claim 7, further comprising representing the list of data types as nodes of a hierarchical graph, each node storing a count of the message components having values of the first field name that match the data type corresponding to the node.

12. The method of claim 1, further comprising generating, by the learning engine, a rule allowing messages having a message component that matches the most restrictive data type to pass.

13. The method of claim 12, further comprising:

receiving a message via the network; and

applying the rule to determine whether to allow the message to pass.

11. A method of a device for filtering messages routing across a network, the method comprising:

extracting, by a filter configured on a device, a plurality of message components from messages received via a network, the plurality of message components identified as uniform resource locator (URL) components at a same hierarchical level of URLs;

creating, by a learning engine configured on the device, a list of data types comprising one or more data types identified for each of the plurality of message components; and

determining, by the learning engine, a most restrictive data type from the list of data types for the plurality of message components.

14. The method of claim 11 wherein extracting further comprises extracting the plurality of message components from messages received via the network over a predefined duration.

15. The method of claim 11 wherein extracting further comprises extracting the plurality of message components from a predefined number of messages received via the network.

16. The method of claim 11, further comprising maintaining, for each data type from the list of data types, a count of message components from the plurality of message components that match the data type.

17. The method of claim 11 wherein determining further comprises:

determining that the number of message components from the plurality of message components matching a first data type exceeds a threshold, the first data type selected from the consolidated plurality of data types; and

assigning the first data type as the most restrictive data type.

18. The method of claim 17, wherein the threshold is based on a fraction of the plurality of message components that should match the most restrictive data type.

19. The method of claim 17, further comprising determining that a count of message components from the plurality of message components matching a child data type does not exceed the threshold, wherein the message components matching the child data type is a subset of message components from the plurality of message components matching the first data type.

20. A system for filtering messages routing across a network, the system comprising:

means for extracting a plurality of message components from messages received via a network, the plurality of message components identified as having at least a field name in common, including a first field name;

means for creating a list of data types for values of the first field name, the list comprising one or more data types of a value of the first field name identified for each of the plurality of message components; and

means for determining a most restrictive data type from the list of data types for the values of the first field name of the plurality of message components.