SYSTEMS AND METHODS FOR EFFICIENT KEYWORD SPOTTING IN COMMUNICATION TRAFFIC

• US 20100313267A1
• Filed: 06/03/2010
• Published: 12/09/2010
• Est. Priority Date: 06/03/2009
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Yaari, Gur, Altman, Yuval, Goldfarb, Eithan, Horovitz, Itsik
• Granted Patent: US 9,053,211 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

Methods and systems related to keyword searching processes. A list of keywords may be first represented by a set of short substrings. The substrings are selected such that an occurrence of a substring indicates a possible occurrence of one or more of the keywords. Input data may be initially pre-processed, so as to identify locations in the input data in which the substrings occur. Then, the identified locations are searched for occurrences of the actual keywords. The pre-processing scheme enables the keyword search process to search only in the identified locations of the substrings instead of over the entire input data.

Claims

1. A method, comprising:

representing a plurality of keywords by a list of substrings drawn from the keywords;

caching a set of flags, each flag indicating whether a respective substring occurs in one or more of the keywords, in an internal cache memory of a processor device;

identifying, using the processor device, locations in input data in which the substrings occur by comparing the input data with the cached flags; and

searching at the identified locations for occurrences of the keywords, so as to find at least one of the keywords in the input data.

2. The method according to claim 1, wherein caching the flags and identifying the locations comprise executing software code by the processor device.

3. The method according to claim 1, wherein the processor device comprises hardware-implemented logic, and wherein caching the flags and identifying the locations are performed by the hardware-implemented logic.

4. The method according to claim 1, wherein the substrings comprise n-bit prefixes of the keywords.

5. The method according to claim 1, wherein each flag indicates whether the respective substring occurs in at least one of multiple predefined offsets within the one or more keywords.

6. The method according to claim 1, and comprising receiving communication traffic from a communication network and extracting the input data from the communication traffic.

7. The method according to claim 1, wherein the input data comprises multiple data packets, wherein identifying the locations comprises identifying a subset of the data packets in which the substrings occur, and wherein searching at the identified locations comprises searching in the identified subset of the data packets.

8. The method according to claim 1, and comprising storing at least a part of the input data that includes the identified locations in a memory, wherein searching for the occurrences comprises searching for the occurrences in at least the part of the input data stored in the memory.

9. The method according to claim 1, and comprising, responsively to finding one or more of the keywords in the input data, performing at least one action selected from a group of actions consisting of:

issuing an alert;

presenting a part of the input data in which the keywords were found; and

blocking a communication flow in which the keywords were found.

10. The method according to claim 1, and comprising discarding some of the input data according to a pre-filtering criterion prior to identifying the locations.

11. Apparatus, comprising:

an interface, which is configured to receive input data; and

a processor, which comprises an internal cache memory and is configured to cache in the internal cache memory a set of flags, which represents a list of substrings drawn from a plurality of keywords such that each flag indicates whether a respective substring occurs in one or more of the keywords, to identify locations in the input data in which the substrings occur by comparing the input data with the cached flags, and to search at the identified locations for occurrences of the keywords, so as to find at least one of the keywords in the input data.

12. The apparatus according to claim 11, wherein the processor is configured to run software code that caches the flags and identifies the locations.

13. The apparatus according to claim 11, wherein the processor comprises hardware-implemented logic, which is operative to cache the flags and identify the locations.

14. The apparatus according to claim 11, wherein the substrings comprise n-bit prefixes of the keywords.

15. The apparatus according to claim 11, wherein each flag indicates whether the respective substring occurs in at least one of multiple predefined offsets within the one or more keywords.

16. The apparatus according to claim 11, wherein the interface is configured to receive communication traffic from a communication network and to extract the input data from the communication traffic.

17. The apparatus according to claim 11, wherein the input data comprises multiple data packets, and wherein the processor is configured to identify a subset of the data packets in which the substrings occur and to search for the occurrences of the keywords in the identified subset of the data packets.

18. The apparatus according to claim 11, and comprising a memory, wherein the interface is configured to store at least a part of the input data that includes the identified locations in the memory, and wherein the processor is configured to search for the occurrences in at least the part of the input data stored in the memory.

19. The apparatus according to claim 11, wherein the processor is configured to perform, responsively to finding one or more of the keywords in the input data, at least one action selected from a group of actions consisting of:

issuing an alert;

presenting a part of the input data in which the keywords were found; and

blocking a communication flow in which the keywords were found.

20. The apparatus according to claim 11, wherein the processor is configured to discard some of the input data according to a pre-filtering criterion prior to identifying the locations.