Arbor Networks, Inc.

Frank P Murphy

Aaron Campbell

Christopher R Hand

A system and method are provided for enabling querying of a large set, including accessing a data structure associated with a metadata parameter and configured to store partial information associated with the data set in a plurality of bins. Each bin, associated with a unique time interval, is configured to store a plurality of entries associated with identified respective members of the metadata parameter's that have a detection time included in the bin's time interval. Each entry has at least one of an updated maximum and minimum possible count value determined using a probabilistic algorithm. The method includes receiving a query having a requested time interval, selecting two or more bins f the data structure that in combination describe the requested time interval, selecting k entries from a combination of the entries in the selected bins based on at least one of an updated maximum and minimum possible count value associated with entries of the selected bins, and determining top-k data, the top-k data including identification of the selected k entries.

System and method for handling top count queries for arbitrary, selectable intervals relating to a large, streamed data set

A method is provided to monitor network traffic, including reserving a portion of a system memory for short-term storage of copied network traffic, wherein the system memory is volatile, receiving copied packets of intercepted network traffic traversing a network, wherein the packets are associated with a plurality of respective traffic streams included in the network traffic, storing the copied packets in the portion of the system memory, maintaining an ordered list per traffic stream of copied packets that are stored, removing copied packets selected, based on their positions in their respective ordered lists, from the portion of the system memory based on a storage constraint, receiving an attack alert identifying a packet that is involved in a network attack, identifying the traffic stream that includes the packet identified, and transferring stored copied packets that are included in the identified traffic stream from the portion of the system memory to a long-term storage device.

Growing community of inventors

Ann Arbor, MI, United States of America

Frank P Murphy