Methods, systems, and computer readable media for heuristics-based adaptive protocol parsing
View Patent ↗Methods, systems, and computer readable media for heuristics-based adaptive protocol parsing are disclosed. According to one aspect, a method for heuristics-based adaptive protocol parsing includes receiving a message of a first protocol, where the first protocol defines a plurality of valid message formats, and parsing the received message using a protocol tree for determining whether the received message is in one of the plurality of valid message formats. While parsing the received message, heuristics are used to optimize the protocol tree. In one embodiment, the protocol tree is optimized for parsing messages having the message format of a received message.
1. A method for heuristics-based adaptive protocol parsing, the method comprising:
receiving, at a hardware communications interface, a message of a first protocol, wherein the first protocol defines a plurality of valid message formats, the message having a format;
parsing the received message using a protocol tree for determining whether the format of the received message is one of the plurality of valid message formats, wherein parsing the receiving message using a protocol tree includes processing information elements (IEs) of the received message while traversing the protocol tree, wherein determining whether the format of the received message is one of the plurality of valid message formats includes determining whether the order of IEs in the received message corresponds to an extant path within the protocol tree; and
while parsing the received message, using heuristics to modify the structure of the protocol tree in real time such that the protocol tree is optimized for processing observed message formats.
2. The method of claim 1 wherein using heuristics to optimize the protocol tree includes optimizing the protocol tree for parsing messages having the format of the received message.
3. The method of claim 1 wherein using heuristics to optimize the protocol tree includes optimizing the protocol tree for parsing messages having the message format that is most often received.
4. The method of claim 1 wherein parsing the received message using a protocol tree comprises parsing the received message using a protocol tree that is embodied in a non-transitory computer readable medium.
5. The method of claim 1 wherein receiving a message comprises receiving a message that includes a plurality of information elements and wherein parsing the received message using a protocol tree comprises using a protocol tree that includes a plurality of nodes, each node corresponding to an information element.
6. The method of claim 5 wherein using heuristics to optimize the protocol tree includes modifying the protocol tree such that observed information elements appear before non-observed information elements in a search of the protocol tree.
7. A system for heuristics-based adaptive protocol parsing, the system comprising:
a protocol tree for defining a plurality of valid message formats; and
a protocol analyzer comprising hardware and for receiving a message having a format, using the protocol tree to parse the received message and determine whether the format of the received message is one of the plurality of valid message formats, wherein parsing the receiving message using a protocol tree includes processing information elements (IEs) of the received message while traversing the protocol tree, wherein determining whether the format of the received message is one of the plurality of valid message formats includes determining whether the order of IEs in the received message corresponds to an extant path within the protocol tree, and, while parsing the received message, using heuristics to modify the structure of the protocol tree in real time such that the protocol tree is optimized for processing observed message formats.
8. The system of claim 7 wherein the protocol analyzer is configured to use heuristics to optimize the protocol tree by optimizing the protocol tree for parsing messages having the format of the received message.
9. The system of claim 7 wherein the protocol analyzer is configured to use heuristics to optimize the protocol tree by optimizing the protocol tree for parsing messages having the message format that is most often received.
10. The system of claim 7 wherein the protocol tree is embodied in a non-transitory computer readable medium.
11. The system of claim 7 wherein the received message comprises a plurality of information elements and wherein the protocol tree comprises a plurality of nodes, each node corresponding to an information element.
12. The system of claim 11 wherein the protocol analyzer is configured to use heuristics to optimize the protocol tree by modifying the protocol tree such that observed information elements appear before non-observed information elements in a search of the protocol tree.
13. A non-transitory computer readable medium having stored thereon executable instructions that when executed by the processor of a computer control the computer to perform steps comprising:
receiving a message of a first protocol, wherein the first protocol defines a plurality of valid message formats, the message having a format;
parsing the received message using a protocol tree for determining whether the format of the received message is one of the plurality of valid message formats, wherein parsing the receiving message using a protocol tree includes processing information elements (IEs) of the received message while traversing the protocol tree, wherein determining whether the format of the received message is one of the plurality of valid message formats includes determining whether the order of IEs in the received message corresponds to an extant path within the protocol tree; and
while parsing the received message, using heuristics to modify the structure of the protocol tree in real time such that the protocol tree is optimized for processing observed message formats.
14. The non-transitory computer readable medium of claim 13 wherein using heuristics to optimize the protocol tree includes optimizing the protocol tree for parsing messages having the format of the received message.
15. The non-transitory computer readable medium of claim 13 wherein using heuristics to optimize the protocol tree includes optimizing the protocol tree for parsing messages having the message format that is most often received.
16. The non-transitory computer readable medium of claim 13 wherein parsing the received message using a protocol tree comprises parsing the received message using a protocol tree that is embodied in the non-transitory computer readable medium.
17. The non-transitory computer readable medium of claim 16 wherein using heuristics to optimize the protocol tree includes modifying the protocol tree such that observed information elements appear before non-observed information elements in a search of the protocol tree.