Patent ID: 9191325
Filing Date: 2015-11-17
Classification: G06F,H04L

Abstract:
1. A method for processing network traffic flow data, comprising: (a) storing flow records characterizing traffic flows, obtained from a network probe device, in memory buckets of first and second bucket chains, the first and second bucket chains having memory buckets corresponding to respective first and second predetermined time windows, wherein the first predetermined time window is T seconds, and the second predetermined time window is equal to, and coincident with, a predetermined number of the first predetermined time windows; further comprising determining a given byte size, comprising: determining a statistical flow profile of traffic flow data, comprising a distribution of number of traffic flows according to respective byte sizes; selecting, from said distribution, the given byte size so that an aggregate of bytes in traffic flows having a size below the given byte size represents a predetermined small percentage of aggregate bytes in all traffic flows in said distribution; and storing the traffic flows of at least a byte size that exceeds the given byte size; wherein count of memory buckets in the first and second bucket chains is limited to respective fixed values, and wherein oldest memory buckets are deleted before starting new memory buckets to keep the count of memory buckets below the respective fixed values; and (b) for each memory bucket, aggregating sizes of the stored flow records, having corresponding selected flow attributes, into summarized flow records.