Patent Document ID: 9584533
Application ID: 14536346
Patent Status: 1

Claim One:
1. A computer-implemented method for network traffic characterization, the method comprising the steps of: acquiring flow data records for a plurality of network data flows associated with an alert signature; generating a plurality of unidimensional traffic clusters based on the acquired flow data records, each of the plurality of unidimensional traffic clusters comprising a plurality of unidimensional nodes, and populating a dynamic Bloom filter with the acquired flow data records; identifying one or more unidimensional traffic clusters matching one or more predefined criteria from the generated plurality of unidimensional traffic clusters; compressing the one or more unidimensional traffic clusters matching one or more predefined criteria into a compressed set of unidimensional nodes based on a predetermined compression threshold; determining if a multidimensional processing of the acquired flow data needs to be performed based on a priority associated with the alert signature; generating a multidimensional lattice corresponding to the plurality of unidimensional traffic clusters, in response to determining that the multidimensional processing is needed, wherein the multidimensional lattice comprises a plurality of multidimensional nodes; traversing the multidimensional lattice and determining, for each multidimensional node under consideration in the multidimensional lattice, if the dynamic Bloom filter contains one or more flow records matching each multidimensional node under consideration and determining if a unidimensional node corresponding to the multidimensional node under consideration is included in the compressed set of unidimensional nodes; and generating a list of flow records matching the multidimensional node under consideration, in response to determining that the unidimensional node corresponding to the multidimensional node under consideration is included in the compressed set of unidimensional nodes and in response to determining that the dynamic Bloom filter contains one or more flow records matching the multidimensional node under consideration, wherein the one or more unidimensional traffic clusters matching one or more predefined criteria comprise one or more unidimensional traffic clusters exceeding a predetermined volume threshold.