Packet Object Database Management for Network Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing volume of network packet data poses challenges in efficient storage and evaluation, leading to time-consuming and costly processes for companies, necessitating a more effective database management system.
Innovation Solution
A system and method for managing packet data using a virtual manager associated with a server to parse and index incoming data based on source, destination, and time of arrival, with a processing module that uses the largest offset value to further index the data, reducing the need for extensive file storage and disk access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional database management processes are used to store and evaluate network packet data, then the data can be stored, but the evaluation process becomes time-consuming and costly
Solution Approach 1:
The patent applies preliminary action by creating indexes on packet data fields (source IP, destination IP, ports, protocols) before queries are executed. This pre-organization of data allows for rapid retrieval during evaluation without scanning entire datasets, thus improving productivity while reducing evaluation time.
Solution Approach 2:
The patent replaces traditional mechanical full-scan database querying with a more efficient indexing and retrieval mechanism. By substituting the brute-force search approach with pre-computed indexes and selective field retrieval, the system achieves faster data evaluation without the time and cost penalties of traditional processes.
2Reliability
If comprehensive packet data is stored for thorough analysis, then evaluation completeness is improved, but storage requirements and disk access increase
Solution Approach 1:
The patent extracts and indexes only the essential fields from packet data (source IP, destination IP, source port, destination port, protocol, timestamp) while storing the complete packet data. This selective extraction creates a compact index structure that maintains evaluation completeness for security analysis while significantly reducing the volume of data that needs to be accessed and processed during queries.
Solution Approach 2:
The patent segments the packet data storage into two parts: a compact indexed structure containing key fields for rapid querying, and the full packet data stored separately. This segmentation allows the system to maintain comprehensive data for reliable evaluation while minimizing the storage footprint and disk access requirements by only accessing the indexed portion during query operations.
Data Source
AI summary
The present disclosure generally provides systems and methods of packet object database management. The database management system includes a database server designed specifically to process binary network packet data. The database server is associated with a parser, query engine, retrieval engine, virtual machine, data manger, and file processor. The database management system uses a proprietary query language to support all accesses to the database. The parser identifies whether the query is a data management query or if it is a data retrieval instruction. If the query is a data management query, the data manager manages the query request and attempts to satisfy the query request. Otherwise, query engine could further analyze or parse the query into a particular query structure or sub-structures to attempt to satisfy the query request.