Granted Patent B2

US 7,917,649 · App. 10/739,299 · Granted Mar 29, 2011

Abstract

Claims (36)

1. A method for monitoring source addresses through statistical clustering of packets, the method comprising:

identifying, via at least one processor module, at least part of a source address of a packet;

searching at least one recorded source address in a data store based on the at least part of the source address, wherein the at least one recorded source address is organized in at least one hierarchical data structure and grouped into at least one cluster, wherein the at least one cluster includes a distribution of source addresses centered around a mean value;

determining whether the at least one cluster contains at least a predetermined number of source addresses; and

routing the packet if the at least part of the source address falls within one of the at least one cluster and the one of the at least one cluster contains at least a predetermined number of source addresses.

2. The method according to claim 1 further comprising discarding the packet if the one of the at least one cluster contains less than the predetermined number of source addresses.

3. The method according to claim 1 further comprising creating a new cluster centered around the at least part of the source address if the at least part of the source address does not fall within the one of the at least one cluster and discarding the packet if the at least part of the source address does not fall within any of the at least one cluster.

4. The method according to claim 1 , wherein the at least one recorded source address is linked to the at least one cluster via pointers or references.

5. The method according to claim 1 , wherein the at least part of the source address is within the one of the at least one cluster if the at least part of the source address is no more than two standard deviations away from the mean value of the one of the at least one cluster.

6. The method according to claim 1 further comprising updating the one of the at least one cluster by:

including the at least part of the source address in the one of the at least one cluster;

recalculating the mean value and a standard deviation for the one of the at least one cluster; and

reorganizing the at least part of the source address and the at least one recorded source address based on the recalculated mean value and standard deviation.

7. The method according to claim 6 further comprising issuing a warning if the updated cluster has an increased standard deviation.

8. The method according to claim 6 further comprising limiting the standard deviation to be no less than a predetermined standard deviation value.

9. The method according to claim 8 , wherein a new cluster is created based on the predetermined standard deviation value.

10. The method according to claim 1 further comprising discarding at least one of the at least one cluster, wherein the at least one of the at least one cluster contains less than the predetermined number of source addresses and has not been updated in a predetermined time period.

11. The method according to claim 1 , wherein the source address of the packet is an Internet protocol (IP) address.

12. The method according to claim 11 , wherein the at least one cluster has a minimum standard deviation value of 128.

13. The method according to claim 12 , wherein a new cluster is created based on the minimum standard deviation value.

14. At least one non-transitory processor readable storage medium for storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1 .

15. A system for monitoring source addresses through statistical clustering of packets, the system comprising:

at least one storage module that records at least one source address, wherein the at least one source address is organized in at least one hierarchical data structure and grouped into at least one cluster, wherein the at least one cluster includes a distribution of source addresses centered around a mean value; and

at least one processor module that:

identifies at least part of a source address of a packet;

queries the storage module based on the at least part of the source address;

determines whether the at least one cluster contains at least a predetermined number of source addresses; and

routes the packet if the at least part of the source address falls within one of the at least one cluster and the one of the at least one cluster contains at least a predetermined number of source addresses.

16. The system according to claim 15 , wherein the processor module further discards the packet if the one of the at least one cluster contains less than the predetermined number of source addresses.

17. The system according to claim 15 , wherein the processor module further creates a new cluster centered around the at least part of the source address if the at least part of the source address does not fall within the one of the at least one cluster and discards the packet if the at least part of the source address does not fall within any of the at least one cluster.

18. A system for monitoring source addresses through statistical clustering of packets, the system comprising:

at least one processor module that:

identifies at least part of a source address of a packet;

searches at least one recorded source address in a data store based on the at least part of the source address, wherein the at least one recorded source address is organized into at least one cluster, wherein the at least one cluster includes a distribution of source addresses centered around a mean value;

determines whether the at least one cluster contains at least a predetermined number of source addresses; and

routes the packet if the at least part of the source address falls within one of the at least one cluster and the one of the at least one cluster contains at least a predetermined number of source addresses.

Assignments (9)