Network Transaction Storage via Configurable Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large and complex computer networking environments, network monitoring systems face challenges in efficiently processing and storing vast amounts of data, particularly image-type data, where it is often unnecessary to store all data for troubleshooting or performance analysis, leading to inefficient storage and data management.
Innovation Solution
A network monitoring system employs configurable pattern matching to determine whether to store transaction data by allowing users to specify patterns and locations within the data, using a configuration file to process and filter out unimportant data, thereby optimizing storage by only saving data of interest.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If all network traffic data is stored for monitoring, then complete data availability is improved, but storage capacity requirements increase significantly
Solution Approach 1:
The patent extracts only the necessary data fields from network traffic packets for storage, rather than storing complete packet data. By identifying and extracting only relevant fields (such as source/destination IPs, ports, protocols, and timestamps) that are needed for monitoring and analysis, the system reduces storage requirements while maintaining essential information availability.
Solution Approach 2:
The patent applies different storage strategies to different data fields based on their importance and characteristics. Critical fields that are frequently queried or analyzed are stored with higher priority and retention policies, while less important fields are either not stored or stored with reduced detail, optimizing the balance between data availability and storage capacity.
2Loss of information
If image type data is stored for troubleshooting, then complete data retention is improved, but storage efficiency deteriorates
Solution Approach 1:
The patent explicitly excludes image type data from storage by extracting only relevant network protocol data fields. Image data, which typically represents file transfers or media content, is identified as unnecessary for network troubleshooting and performance analysis, and is therefore not stored, improving storage efficiency while retaining only essential network layer information.
Solution Approach 2:
The patent changes the storage parameter from complete packet data to selected field data. By modifying what data is stored (changing the data scope from all packet contents to only specific protocol fields), the system achieves better storage efficiency while maintaining adequate data retention for network analysis purposes.
3Adaptability or versatility
If pattern matching configuration is added to determine storage, then data management capability is improved, but device complexity increases
Solution Approach 1:
The patent implements preliminary action by allowing administrators to pre-configure storage policies and pattern matching rules before network monitoring begins. Storage decisions are made in advance based on predefined criteria (such as time-based retention, protocol-specific policies, or threshold-based filtering), reducing the need for complex real-time decision logic and simplifying the monitoring device architecture.
Solution Approach 2:
The patent introduces a configuration file or policy manager as an intermediary between the network monitoring device and storage decisions. This intermediary component handles the complexity of pattern matching and storage determination externally, allowing the monitoring device to remain relatively simple while still providing sophisticated data management capabilities through configurable policies.
Data Source
AI summary
A network analyzer, system and method determine whether or not network transaction data derived from network analysis should be stored, based on a configuration. Configuration strings (patterns) are entered via a configuration file, including specifying whether the string should be a prefix, suffix, other location or exist anyplace in the data. Storage enabling/disabling is provided for network transaction data. Configuration strings (patterns) can be specified for request/response summary/detail, and for specified parameters.