Efficient classification of network packets

摘要

Embodiments describe a system and/or method for efficient classification of network packets. According to an aspect a method includes describing a packet as a feature vector and mapping the feature vector to a feature space. The method can further include defining a feature prism, classifying the packet relative to the feature prism, and determining if the feature vector matches the feature prism. If the feature vector matches the feature prism the packet is passed to a data recipient, if not, the packet is blocked. Another embodiment is an apparatus that includes an identification component that defines at least one feature of a packet and a classification component that classifies the packet based at least in part upon the at least one defined feature.

主权项

1. A method comprising:
receiving a communication packet from an entity; defining the packet as an n-dimensional feature vector, the n-dimensional feature vector comprising n feature values; mapping the n-dimensional feature vector to a point in an n-dimensional affine feature space; defining a feature prism within the n-dimensional affine feature space, wherein the feature prism is an axes aligned n-dimensional cuboid defined by specifying a contiguous subrange for each feature, and wherein the feature prism represents a set of geometrically coherent classification criteria; and classifying the packet, wherein classifying the packet comprises determining whether the feature prism encloses the n-dimensional feature vector, and wherein the feature prism encloses the n-dimensional feature vector when each of the n feature values of the n-dimensional feature vector is within the contiguous subrange specified in the feature prism for that feature.