Granted Patent B2

US 12,388,732 · App. 18/243,967 · Granted Aug 12, 2025

Inventors: Mattias Harrysson (Tokyo, JP); Yasuyuki Hamada (Tokyo, JP)

Assignee: NTT Security Holdings Corporation

H04L43/062H04L43/067

Abstract

Claims (31)

1. A method for finding a historic netflow having a particular IP address, the method comprising:

retrieving, by a historic netflow computer system, a plurality of netflow blobs each containing a plurality of netflows wherein each netflow contains data about data traffic between an internet protocol (IP) address of a source host and the IP address of a destination host during a certain period of time in the past, each of the plurality of netflow blobs containing the plurality of netflows over a different period of time in the past;

receiving, by the historic netflow computer system, a request to find a requested IP address during a searchable period of time, wherein the requested IP address is findable in at least two of the network blobs that have netflows over different periods of time in the past;

generating, by the historic netflow computer system, a blob index file for each of the at least two netflow blobs, each blob index file containing each of a plurality of IP addresses in the netflow blob for a different period of time in the past;

generating, by the historic netflow computer system, a bitset for one of the at least two netflow blobs having a longest time period, wherein the bitset contains a set of bits in a word wherein each IP address of the plurality of IP addresses in the netflow blob having the longest period of time is converted into a bit in the bitset, wherein each bit in the bitset corresponds to the actual IP address;

performing, by the historic netflow computer system, a search, using the bitset and the at least two blob index files, to find a historic netflow having the requested IP address in a netflow during the searchable period of time; and

displaying, on a display of a user computing device, the found historic netflow having the requested IP address.

2. The method of claim 1 further comprising forming a search tree having a root that is the generated bitset and a plurality of leaves wherein each leaf is one of the generated blob index files and wherein performing the search further comprises checking, in each blob index file, if the requested IP address appears in the blob index file.

3. The method of claim 2 , wherein the performing the search further comprises identifying a particular netflow blob to be processed having the requested IP address using the blob index file corresponding to the particular netflow blob and one or more bitsets corresponding to the particular netflow blob and searching the identified particular netflow blob to find a historic netflow having the request IP address during a time interval of the particular netflow blob.

4. The method of claim 3 further comprising queuing the identified particular netflow blobs and finding the requested IP address in each identified particular netflow blob in the queue.

5. The method of claim 1 , wherein the period of time is one of an hour, a month and a day.

6. The method of claim 1 , wherein the generated bitset is a sixty-four bit word.

7. The method of claim 1 further comprising generating a plurality of bitsets wherein each generated bitset has a time period that varies between a shortest time interval, a short time interval and a longest time interval and wherein performing the search for the historic netflow further comprises performing the search using the generated bitset having the longest time interval, performing the search using the generated bitset having the short time interval if the requested IP address is contained in the longest time interval bitset and performing the search using the generated bitset having the shortest time interval if the requested IP address is contained in the short time interval bitset to find the historic netflow with the requested IP address.

8. The method of claim 1 , wherein the requested IP address is an IPv4 IP address.

9. A system for finding a historic netflow having a particular IP address, the system comprising:

a historic network finding computer system having a processor and a memory;

a computing device of a user that is connectable to the historic network finding computer system;

wherein the processor of the historic network finding computer system is configured to:

retrieve a plurality of historic netflow blobs each containing a plurality of netflows wherein each netflow contains data about data traffic between an internet protocol (IP) address of a source host and the IP address of a destination host during a certain period of time in the past, each of the plurality of netflow blobs containing the plurality of netflows over a different period of time in the past;

receive a request to find a requested IP address during a searchable period of time, wherein the requested IP address is findable in at least two of the network blobs that have different periods of time in the past;

generate a blob index file for each of the at least two netflow blobs, each blob index file containing each of a plurality of IP addresses in the netflow blob for a different period of time in the past;

generate a bitset for one of the at least two netflow blobs having a longest time period, wherein the bitset contains a set of bits in a word wherein each IP address of the plurality of IP addresses in the netflow blob having the longest period of time is converted into a bit in the bitset, wherein each bit in the bitset corresponds to the actual IP address; and

perform a search, using the bitset and the at least two blob index files, to find a historic netflow having the requested IP address in a netflow during the searchable period of time; and

wherein a display of the computing device displays the found historic netflow having the requested IP address.

10. The system of claim 9 , wherein the processor is further configured to form a search tree having a root that is the generated bitset and a plurality of leaves wherein each leaf is one of the generated blob index files and check, in each blob index file, if the requested IP address appears in the blob index file.

11. The system of claim 10 , wherein the processor is further configured to identify a particular netflow blob to be processed having the requested IP address using the blob index file corresponding to the particular netflow blob and one or more bitsets corresponding to the particular netflow blob and search the identified particular netflow blob to find a historic netflow having the request IP address during a time interval of the particular netflow blob.

12. The system of claim 11 , wherein the processor is further configured to queue the identified particular netflow blobs and find the requested IP address in each identified particular netflow blob in the queue.

13. The system of claim 9 , wherein the period of time is one of an hour, a month and a day.

14. The system of claim 9 , wherein the generated bitset is a sixty-four bit word.

15. The system of claim 9 , wherein the processor is further configured to generate a plurality of bitsets wherein each generated bitset has a time period that varies between a shortest time interval, a short time interval and a longest time interval, perform the search for the requested IP address in the netflow blob using the generated bitset having the longest time interval, perform the search for the requested IP address in the netflow blob using the generated bitset having the short time interval if the requested IP address is contained in the longest time interval bitset and perform the search for the requested IP address in the netflow blob using the generated bitset having the shortest time interval if the requested IP address is contained in the short time interval bitset to find the historic network with the requested IP address.

16. The system of claim 9 , wherein the requested IP address is an IPv4 IP address.

Assignments (1)

Continuity (1)

References Cited (69)