IP Library › Granted Patent US 9,445,095
Granted Patent B1
US 9,445,095 · App. 13/646,899 · Granted Sep 13, 2016

Compression of modified data captures for packets with encrypted or non-interesting content

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,445,095
App. No.
13/646,899
Filed
Oct 8, 2012
Granted
Sep 13, 2016
Kind
B1
Examiner
HABIB, IRFAN
Art Unit
2485
USPC
375/240.26
Abstract

Various methods, systems, and apparatuses can be used to remove uninteresting data from captured data prior to transmission of the captured data for analysis. In some implementations, a compression module is operable to modify capture data by replacing encrypted content with tags, and to compress the resulting modified data using various compression algorithms.

Claims (53)

1. A computer-implemented method, comprising:

capturing data packets at a network device, wherein each captured data packet comprises one or more encrypted portions and one or more unencrypted portions;

storing the captured data packets to a data store;

modifying each respective one of the captured data packets, wherein modification of each respective one captured data packet comprises the steps of:

identifying each of one or more encrypted portions of the respective data packet;

removing the one or more encrypted portions from the respective data packet; and

replacing each respective one of the one or more encrypted portions of the respective data packet with tag information, wherein the tag information is unencrypted, is placed within the modified data packet at a location previously occupied by the respective encrypted portion, and comprises an identification of one or more properties of the respective encrypted portion;

compressing the modified data packets; and

transmitting the compressed modified data packets to an analysis device.

2. The computer-implemented method of claim 1 , wherein the packets are modified and compressed prior to storing the captured data packets to the data store.

3. The computer-implemented method of claim 1 , further comprising periodically modifying and compressing the data packets after the captured data packets have been stored to the data store.

4. The computer-implemented method of claim 1 , wherein the stored data packets are modified and compressed immediately prior to being transmitted to the analysis device.

5. The computer-implemented method of claim 1 , wherein the one or more properties comprises a size associated with the replaced portion of the data packets.

6. The computer-implemented method of claim 1 , wherein the one or more properties comprises a type associated with the replaced portion of the data packets.

7. The computer-implemented method of claim 1 , wherein the tag information used to replace the encrypted portions of the captured data packets is optimized to achieve a maximum compression ratio.

8. The computer-implemented method of claim 1 , further comprising:

reconstructing the compressed data packets to produce reconstructed data packets by:

decompressing the compressed data packets; and

inserting random information into the portions of the data packets identified by the tag information; and

analyzing the reconstructed data packets.

9. A system, comprising:

a data capture module operable to instruct a network node to capture data packets received at the network node, wherein each captured data packet comprises one or more encrypted portions and one or more unencrypted portions;

a data store operable to store the captured data packets;

a compression module operable to:

modify each respective one of the captured data packets, wherein modification of each respective one captured data packet comprises:

identifying each of one or more encrypted portions of the respective data packet;

removing the one or more encrypted portions from the respective data packet; and

replacing each respective one of the one or more encrypted portions of the respective data packet with tag information, wherein the tag information is unencrypted, is placed within the modified data packet at a location previously occupied by the respective encrypted portion, and comprises an identification of one or more properties of the respective encrypted portion; and

compress the modified data packets;

the data capture module being further operable to transmit the compressed modified data packets to an analysis device.

10. The system of claim 9 , wherein the compression module is operable to modify and compress the captured data packets prior to storing the captured data packets to the data store.

11. The system of claim 9 , wherein the compression module is operable to periodically modify and compress the data packets after the captured data packets have been stored to the data store.

12. The system of claim 9 , wherein the compression module is operable to modify and compress the stored data packets immediately prior to the packets being transmitted to the analysis device.

13. The system of claim 9 , wherein the tag information used to replace the encrypted portions of the captured data packets is optimized to achieve a maximum compression ratio.

14. The system of claim 9 , further comprising an analysis module operable to reconstruct the compressed data packets to produce reconstructed data packets by decompressing the compressed data packets, and inserting random information into the portions of the data packets identified by the tag information, and wherein the analysis module is further operable to analyze the reconstructed data packets to identify problems within the network.

15. One or more computer-readable media operable to be executed by one or more computer processors, the computer-readable media, upon execution by the one or more computer processors being operable to cause the one or more computer processors to:

capture data packets at a network device, wherein each captured data packet comprises one or more encrypted portions and one or more unencrypted portions;

store the captured data packets to a data store;

modify each respective one of the captured data packets, wherein modification of each respective one captured data packet comprises the steps of:

identifying each of one or more encrypted portions of the respective data packet;

removing the one or more encrypted portions from the respective data packet; and

replacing each respective one of the one or more encrypted portions of the respective data packet with tag information, wherein the tag information is unencrypted, is placed within the modified data packet at a location previously occupied by the respective encrypted portion, and comprises an identification of one or more properties of the respective encrypted portion;

compress the modified data packets; and

transmit the compressed modified data packets to an analysis device.

16. The one or more computer readable media of claim 15 , further operable to cause the one or more processors to:

reconstruct the compressed data packets to produce reconstructed data packets by:

decompressing the compressed data packets; and

inserting random information into the portions of the data packets identified by the tag information; and

analyze the reconstructed data packets.

17. The system of claim 9 , wherein the one or more properties comprises a size associated with the replaced portion of the data packets.

18. The system of claim 9 , wherein the one or more properties comprises a type associated with the replaced portion of the data packets.

19. The one or more computer readable media of claim 15 , wherein the one or more properties comprises a size associated with the replaced portion of the data packets.

20. The one or more computer readable media of claim 15 , wherein the one or more properties comprises a type associated with the replaced portion of the data packets.