Patent ID: 8782092

Claim:
An apparatus, comprising: a processing system comprising at least one processor and a memory storing a set of computer instructions, the processing system is arranged to cause the apparatus to: receive a plurality of flow records; filter information contained in the plurality of flow records based on defined filter parameters; extract an indicator associated with the filtered flow record; store a predetermined number of indicators in an indicator data structure; determine if the indicator data structure has a capacity to store an additional indicator; add the extracted indicator to the data structure when it is determined that the indicator data structure has the capacity; analyze the extracted indicators stored in the data structure to remove at least one of the stored extracted indicators when it is determined that the indicator data structure does not have the capacity to store an additional indicator wherein the step of analyzing further comprises calculating the median of each value associated with the stored indicators and removing the stored indicators with associated values that are less than the calculated median; and store in a hash table a plurality of indicators that are stored in the indicator data structure; and determine whether an extracted indicator is stored in the indicator data structure by performing a lookup of the indicator using the hash table.