Abstract: A method for organizing network flow information within a relational database relates to minimizing contention for the network flow information. In particular, data is generally aggregated at certain time intervals and separately organized. In this way, contention is decreased as analysis can occur on the separated existing flow records, which are optionally aggregated, while new raw flow records are stored. In another embodiment, the aggregated data can be re-aggregated at second, larger time intervals.

Abstract: Embodiments of the invention include an apparatus, method, and computer program for progressive charting of network traffic flow data. The method includes, in one example, receiving, at a network traffic analyzer, a query of network traffic flow data over a certain time period. The method further includes modifying the query to produce sub-queries each based on different segments of time within the certain time period, executing at least one of the sub-queries, and incrementally outputting results of each of said executed sub-queries as each of the sub-queries are completed.

Abstract: A method for aggregating network flow information within a relational database relates to by maximizing concurrency between insertion and analysis of database records. In particular, data is generally stored according to the network devices associated with the flow records. Then, the flow records for the separate devices may be aggregated at certain time intervals and separately organized. In this way, contention is decreased as analysis can occur on the aggregated flow records, while new flow records are stored. In another embodiment, the aggregated data can be reaggregated again at a second, larger time interval.

Abstract: To organize flows records into buckets and optimize their indexed access to/from storage medium, a bucket identifier is associated with each flow record. The bucket identifier is derived from some other characteristic of the network flow, such as a timestamp or source identification associated with the network flow. In this way, contention is decreased as analysis can occur on the aggregated flow records, while new flow records are stored.

Abstract: Embodiments of the invention include an apparatus, method, and computer program for progressive charting of network traffic flow data. The method includes, in one example, receiving, at a network traffic analyzer, a query of network traffic flow data over a certain time period. The method further includes modifying the query to produce sub-queries each based on different segments of time within the certain time period, executing at least one of the sub-queries, and incrementally outputting results of each of said executed sub-queries as each of the sub-queries are completed.

Abstract: A method for aggregating network flow information within a relational database relates to by maximizing concurrency between insertion and analysis of database records. In particular, data is generally stored according to the network devices associated with the flow records. Then, the flow records for the separate devices may be aggregated at certain time intervals and separately organized. In this way, contention is decreased as analysis can occur on the aggregated flow records, while new flow records are stored. In another embodiment, the aggregated data can be reaggregated again at a second, larger time interval.

Abstract: To organize flows records into buckets and optimize their indexed access to/from storage medium, a bucket identifier is associated with each flow record. The bucket identifier is derived from some other characteristic of the network flow, such as a timestamp or source identification associated with the network flow. In this way, contention is decreased as analysis can occur on the aggregated flow records, while new flow records are stored.

Abstract: A method for organizing network flow information within a relational database relates to minimizing contention for the network flow information. In particular, data is generally aggregated at certain time intervals and separately organized. In this way, contention is decreased as analysis can occur on the separated existing flow records, which are optionally aggregated, while new raw flow records are stored. In another embodiment, the aggregated data can be re-aggregated at second, larger time intervals.