Method and apparatus for user identification in computer traffic
Techniques are provided for determining whether network traffic includes a user identifier of interest. Each byte of network traffic is classified as being either a valid character, an invalid character, or a delimiter character. An information stream can be generated based on the classification. Storage of valid characters in the information stream can be initiated when a first delimiter character is detected. Storage of valid characters in the information stream can be stopped when a second delimiter character is detected. The stored valid characters between the first delimiter character and the second delimiter character can be examined to determine whether the stored valid characters correspond to a user identifier.
1. A method for identifying data associated with a desired entity, wherein the data is contained in a plurality of information exchanged over a network, and wherein the method operates irrespective of a protocol, the method comprising:
receiving, at a translator, a byte of information from the plurality of information;
classifying, by the translator, the byte of information as being one of a valid character, an invalid character, and a delimiter;
concatenating, at a register, an information unit to a string of characters in response to classifying the byte of information as the valid character, wherein the string is in the register;
clearing the register in response to classifying the byte of information as one of the invalid character and the delimiter;
responsive to classifying the byte of information as the delimiter, determining, by a determinator module, whether the string contains a number of characters that is greater than a predetermined minimum value and less than a predetermined maximum value, unless the register was last cleared in response to classifying the byte of information as the invalid character;
comparing, by a comparator module, the string to a set of desired entities in response to determining that the number of characters is greater than a predetermined minimum value and less than a predetermined maximum value; and
responsive to identifying the desired entity in the string, storing data associated with the string.
2. The method of claim 1 wherein decoding of a plurality of different protocols is avoided.
3. The method of claim 1 wherein the desired entity comprises a user identifier.
4. The method of claim 3 wherein the data associated with the string comprises an email.
5. The method of claim 4 wherein decoding of an email protocol associated with the email is avoided.
6. The method of claim 4 further comprising:
checking for a second email from the desired entity to another desired entity.
7. The method of claim 4 further comprising:
determining if the email is being sent to the desired entity or from the desired entity.
8. The method of claim 1 wherein the set of desired entities comprises a hash table and wherein the method further comprises:
hashing the string, wherein a hashed string is generated, and wherein comparing comprises comparing the hashed string to a hash key.
9. A computer-readable storage medium storing a software module that, when executed on a computer, performs a method for identifying data associated with a desired entity, wherein the data is contained in a plurality of information exchanged over a network, and wherein the method operates irrespective of a protocol the method comprising:
receiving, at a translator, a byte of information from the plurality of information;
classifying, by the translator, the byte of information as being one of a valid character, an invalid character, and a delimiter;
concatenating, at a register, an information unit to a string of characters in response to classifying the byte of information as the valid character, wherein the string is in the register;
clearing the register in response to classifying the byte of information as one of the invalid character and the delimiter;
responsive to classifying the byte of information as the delimiter, determining, by a determinator module, whether the string contains a number of characters that is greater than a predetermined minimum value and less than a predetermined maximum value, unless the register was last cleared in response to classifying the byte of information as the invalid character;
comparing, by a comparator module, the string to a set of desired entities in response to determining that the number of characters is greater than a predetermined minimum value and less than a predetermined maximum value; and
responsive to identifying the desired entity in the string, storing data associated with the string.
10. The computer-readable storage medium of claim 9 wherein decoding of a plurality of different protocols is avoided.
11. The computer-readable storage medium of claim 9 wherein the desired entity comprises a user identifier.
12. The computer-readable storage medium of claim 11 wherein the data associated with the string comprises an email.
13. The computer-readable storage medium of claim 12 wherein decoding of an email protocol associated with the email is avoided.
14. The computer-readable storage medium of claim 12 wherein the method further comprises:
checking for a second email from the desired entity to another desired entity.
15. The computer-readable storage medium of claim 12 wherein the method further comprises:
determining if the email is being sent to the desired entity or from the desired entity.
16. The computer-readable storage medium of claim 9 wherein the set of desired entities comprises a hash table and wherein the method further comprises:
hashing the string, wherein a hashed string is generated, and wherein comparing comprises comparing the hashed string to a hash key.
17. A data processing system comprising:
a processor;
a bus connected to the processor; and
a first memory connected to the bus, wherein the memory stores a software module that, when executed by the processor, performs a method for identifying data associated with a desired entity, wherein the data is contained in a plurality of information exchanged over a network, and wherein the method operates irrespective of a protocol
a translator for receiving a byte of information from the plurality of information, wherein the translator classifies the byte of information as being one of a valid character, an invalid character, and a delimiter;
a register for concatenating an information unit to a string of characters in response to classifying the byte of information as the valid character, wherein the string is in the register;
a state machine for clearing the register in response to classifying the byte of information as one of the invalid character and the delimiter;
a determinator module for determining, in response to classifying the byte of information as the delimiter, whether the string contains a number of characters that is greater than a predetermined minimum value and less than a predetermined maximum value, unless the register was last cleared in response to classifying the byte of information as the invalid character;
a comparator module for comparing the string to a set of desired entities in response to determining that the number of characters is greater than a predetermined minimum value and less than a predetermined maximum value; and
a second memory for storing data associated with the string in response to identifying the desired entity in the string.
18. The data processing system of claim 17 wherein decoding of a plurality of different protocols is avoided.
19. The data processing system of claim 17 wherein the desired entity comprises a user identifier.
20. The data processing system of claim 19 wherein the data associated with the string comprises an email.
21. The data processing system of claim 20 wherein decoding of an email protocol associated with the email is avoided.
22. The data processing system of claim 20 wherein the method further comprises:
checking for a second email from the desired entity to another desired entity.
23. The data processing system of claim 20 wherein the method further comprises:
determining if the email is being sent to the desired entity or from the desired entity.
24. The data processing system of claim 17 wherein the set of desired entities comprises a hash table and wherein the method further comprises:
hashing the string, wherein a hashed string is generated, and wherein comparing comprises comparing the hashed string to a hash key.