Presentation of an extracted artifact based on an indexing technique

• US 8,521,732 B2
• Filed: 05/25/2009
• Issued: 08/27/2013
• Est. Priority Date: 05/23/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Solera Networks, Inc. (Gen Digital Inc.)
• Inventors: Wood, Matthew Scott, Tveit, Paal, Edginton, Brian, Shillingford, Steve, Brown, James, Levy, Joseph H, Arnold, Daniel M
• Primary Examiner(s): MORRISON, JAY A
• Application Number:
  US12/471,433
• Publication Number:
  US 20090292681A1
• Time in Patent Office: 1,555 Days
• Field of Search: None
• US Class Current: 707/731
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 7/00 Methods or arrangements for processing data by operating upon the order or content of the data handled logic circuits H03K19/00
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

A system and method of presentation of an extracted artifact based on an indexing technique are disclosed. In an embodiment, the method includes indexing a database of a captured network characteristic data using a processor and a memory to form an indexed capture data. The method includes enhancing a query response time with the indexed capture data. The method further includes searching the indexed capture data to generate a capture query result. The capture query result includes an extracted artifact. The method also includes graphically presenting the capture query result as at least one of an artifact list and an artifact image.

Claims

1. A method, comprising:

indexing a database of captured network characteristic data, wherein the captured network characteristic data includes payload data and artifact characteristic data for captured network packets subject to network packet level processing, wherein the captured network packets include local area network packets and wide area network packets;

presenting a query interface that specifies parameters derived from network packet level processing;

receiving a query from the query interface, wherein the query includes specified parameters from the query interface, wherein the specified parameters include wide area network content filtering, local area network content filtering and desktop content filtering;

processing the query and the specified parameters against the database to form search results; and

supplying the search results in response to the query, wherein the search results include a wide area network search results section, a local area network search results section and a desktop search results section.

2. The method of claim 1 wherein parameters derived from network packet level processing include a user internet protocol address.

3. The method of claim 1 wherein parameters derived from network packet level processing include network transport mechanisms.

4. The method of claim 3 wherein the network transport mechanisms include HTTP sessions.

5. The method of claim 3 wherein the network transport mechanisms include FTP sessions.

6. The method of claim 1 further comprising acquiring a snapshot of an artifact image in network packets.

7. The method of claim 6 further comprising forming a thumbnail view of the snapshot.

8. The method of claim 7 further comprising providing the thumbnail view with the search results.

9. The method of claim 1 wherein the search results are organized by content type.

10. The method of claim 1 wherein the database categorizes payload data as at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a presentation, a program file and a data package.