Patent ID: 7975044
Filing Date: 2011-07-05
Classification: G06F,H04L

Abstract:
1. A method for partitioning a plurality of communication data relating to communication between at least one client computer and at least one server in a network, the plurality of communication data being associated with a plurality of ports and comprising ephemeral communication data, the method comprising: determining a first parameter for each port associated with the plurality of communication data, the first parameter corresponding to a number of connections on each port; determining a second parameter for each port associated with the plurality of communication data, the second parameter corresponding to a number of servers using each port; utilizing the first parameter and the second parameter for each port associated with the plurality of communication data to represent each port as a point in a two-dimensional space such that each port is represented by a set of points; applying a first data clustering to the set of points; based on the first data clustering, automatically identifying a portion of the set of points for which the first parameter and the second parameter are high, wherein ports corresponding to the portion of the set of points comprise global ports associated with first non-ephemeral communication data; eliminating the portion of the set of points from the set of points such that first communication data associated with the global ports is removed from the plurality of communication data; after removing the first communication data from the plurality of communication data, determining server, port pairs associated with the plurality of communication data remaining after the first communication data is removed; determining a third parameter for each server, port pair, the third parameter corresponding to a number of connections associated with each server, port pair; based on the third parameter for each server, port pair, applying a second data clustering to the server, port pairs; based on the second data clustering, automatically identifying a portion of the server, port pairs associated with a high number of connections, wherein the portion of the server, port pairs associated with the high number of connections comprises heavy hitter server, port pairs associated with second non-ephemeral communication data; eliminating second communication data associated with the heavy hitter server, port pairs from the plurality of communication data remaining after the first communication data is removed; and automatically identifying at least a portion of the plurality of communication data remaining after the first communication data and the second communication data are removed as the ephemeral communication data.