Method for summarizing flow information of network devices

摘要

A method for organizing network flow information within a relational database relates to minimizing contention for the network flow information. In particular, data is generally aggregated at certain time intervals and separately organized. In this way, contention is decreased as analysis can occur on the separated existing flow records, which are optionally aggregated, while new raw flow records are stored. In another embodiment, the aggregated data can be re-aggregated at second, larger time intervals.

主权项

1. A system for aggregating network flow information, the system comprising:
a flow generating device configured to generate flow records from network traffic and to export the flow records to a data collection server comprising a non-transitory storage device, the storage device comprising
a raw data table comprising new flow records for a current time period; anda first aggregated data table comprising first aggregated flow records for a first prior time period and a second aggregated data table comprising second aggregated flow records for a second prior time period,wherein, when the new flow records age beyond a predefined threshold, the new flow records are aggregated in the same raw data table and the raw data table becomes an aggregated data table and a new raw data table is created in the storage device,wherein said current time period, said first prior time period, and said second prior time period do not overlap,wherein the new flow records are sampled prior to being aggregated, and wherein the sampled flow records comprise estimations of flow volume.