Remote Capture Agent Custom Content Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network capture systems are not easily modifiable to address different business needs and struggle with handling large volumes of network data, as they are typically designed for specific purposes and incur high costs to store all data, with much being uninteresting and unnecessary.
Innovation Solution
A system that extracts custom content from network packets by parsing packets to determine protocols, applying custom-content-extraction rules, and storing extracted content in a data store for subsequent queries, using a late-binding schema to facilitate flexible data retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all network data is stored for subsequent analysis, then complete data availability is achieved, but storage costs become prohibitively expensive
Solution Approach 1:
The patent extracts only the specific fields containing interesting data from network packets according to predefined extraction rules, rather than storing entire packets. This selective extraction significantly reduces storage requirements while maintaining availability of relevant information for analysis.
Solution Approach 2:
The system applies different extraction rules to different packet fields based on their specific characteristics and relevance to analysis needs. Each field is processed according to its own extraction rules, optimizing storage efficiency while preserving necessary data quality for specific analytical purposes.
2Manufacturing precision
If network capture systems are customized for specific purposes, then functional precision is improved, but adaptability to different business needs deteriorates
Solution Approach 1:
The extraction rules are configured dynamically based on different business needs and analysis purposes. The system can adapt its extraction behavior by loading different rule sets without requiring hardware reconfiguration, thus maintaining functional precision for specific tasks while achieving versatility across different business scenarios.
Solution Approach 2:
The system changes extraction parameters such as field selection criteria, extraction patterns, and processing rules according to different business requirements. This allows the same capture system to be precisely optimized for different purposes by adjusting parameters rather than physical configuration.
3Manufacturing precision
If custom-content-extraction rules are applied to each packet, then data extraction precision is improved, but processing time increases
Solution Approach 1:
Extraction rules are pre-configured and compiled before packet processing begins. The system prepares extraction patterns, field mappings, and processing logic in advance, allowing rapid application of precise extraction rules during actual packet processing without the overhead of dynamic rule interpretation.
Data Source
AI summary
In the disclosed embodiments, a remote capture agent monitors network packets traversing a network interface of a computing device in an information technology environment. Network data is obtained from the network packets. The network data is modified based on configuration information obtained by the remote capture agent from a configuration server to obtain modified network data. Timestamped events are generated based on the modified network data, and the timestamped events are sent to another component on the network for subsequent processing.