ENTROPY AND VALUE BASED PACKET TRUNCATION

摘要

#$%^&*AU2018250409A120190502.pdf#####ABSTRACT OF DISCLOSURE In one embodiment, a computer-implemented method of conserving storage space in a network recorder includes receiving a computer packet including a header and payload data; estimating entropy of the payload data in the computer packet; determining if storage of the computer packet is of value or not based on the header of the computer packet; and storing all or a portion of the computer packet into a storage device based on the estimated entropy and the value determination. 321/9 FIG. 1R 100A LU MONITOR 150N Client Cloud 101A MALICIOUS CLIENT 152N 168- ROUTER 166 FIREWALL 2 TAP 2/ Sw INR 2 200A 170 S 200B a - 200C, l' NGA1 E| NGA 2 NA NGA4 200D 2 82 2 2COLCO NFC1 ' NFC2 NF3 ' NFC4 162A 2162B Network 162 162D /Switch 216 111A Ethernet 2 110A 4'Ethernet 111B C ENT RAL 120 N 124C 124D N 120B Flash 156L 112 Server Appliance Server 112B ANALYZER 122A- 113C 122B 2 113N 2 MONITOR 2,' 2 Tiered 2 KEB2R 113BArray 113E 2 113G 14 114 113 G 158 124 F EG_2 Tiered Array Storage Storage 124 114A 116 Array Array "1-6B2/9 --f898CZZ3 -- 8Nz N | 00 p ... ~ P0