Network Traffic Characterization Using Bloom Filters and Dimensional Segmentation

The patent segments the traffic analysis process into multiple dimensions (unidimensional clusters first, then multidimensional lattice). It divides the complex task of comprehensive traffic profiling into manageable steps: acquiring flow data, generating unidimensional clusters, compressing them, and only then performing multidimensional processing when needed. This segmentation reduces processing complexity while maintaining comprehensive understanding capability.

The patent transitions from unidimensional clustering to multidimensional lattice processing. It first processes traffic data in one dimension to create clusters, then organizes these clusters into a multidimensional lattice structure that enables comprehensive traffic behavior understanding. This dimensional transition allows the system to handle complex traffic patterns efficiently by building upon simplified unidimensional representations.

The patent performs preliminary unidimensional clustering and compression before multidimensional processing. It pre-processes the traffic data to generate and compress unidimensional traffic clusters, creating a simplified representation that can be efficiently processed in subsequent multidimensional operations. This preliminary action reduces the amount of data that needs to be processed in the more time-consuming multidimensional stage.

The patent applies partial multidimensional processing only when necessary, determined by alert signature priority. Instead of performing comprehensive multidimensional analysis on all traffic data, it selectively applies the more resource-intensive processing only to high-priority alerts, achieving sufficient pattern identification accuracy for critical security events while avoiding unnecessary processing time consumption for lower-priority traffic.