Method and Apparatus for Communications Analysis

Abstract

A method of grouping communication sessions, the method comprising: selecting a plurality of communications sessions from a data stream; determining which data structures, of said communication sessions, occur more frequently than chance; and sorting the communication sessions into groups, wherein communication sessions which have similar data structures, determined to occur more frequently than chance, are sorted into the same group.

1 . A method of configuring a sensor to extract data from a communication data stream, using a group of communication sessions representing a particular communications protocol, the group comprising data structures representative of that protocol, the method comprising:
 generating a plurality of records representing said data structures, each record having a particular pattern;   grouping said records based on the similarity of said patterns, such that each group includes records having the same pattern;   generating a template based on the pattern of each group; and   configuring said sensor using said template.   
     
     
         2 . A method according to  claim 1 , wherein, each record includes an entity and the context of that entity. 
     
     
         3 . A method according to  claim 1 , further comprising:
 extracting said data structures from a group of communication sessions, prior to generating said records;   searching for occurrences of those structures in a data stream;   extracting packets containing those occurrences; and   generating said records on the basis of the extracted packets.   
     
     
         4 . A method according to  claim 3 , further comprising aligning the records which have been generated. 
     
     
         5 . A method according to  claim 4 , wherein the alignment is performed using the Needleman-Wunsch algorithm. 
     
     
         6 . A method according to  claim 4 , further comprising determining the similarity of the records after aligning the records. 
     
     
         7 . A method according to  claim 6 , wherein the step of determining similarity is performed using a similarity measure. 
     
     
         8 . A method according to  claim 7 , wherein the similarity measure is a cosine-like similarity measure.
 compare each session using a similarity measure; and   cluster the sessions based on vector similarity.