Abstract: Systems and methods for performing customizable analysis of a communication session between two entities includes loading predetermined first parser definitions, stored as at least one binary file, receiving second parser definitions in a form other than a binary file form, after the first parser definitions are already operating, loading and compiling the second parser definitions, and applying the first and second parser definitions to a communication session, wherein the first parser definitions identify standard components of the communication session and the second parser definitions are customizable and identify non-standard components of the communication session.

Abstract: A system for, and method of, extracting information from multiple sessions and in accordance with disparate protocols, and transforming the same into a common language. Packets are collected by packet collectors distributed throughout a network and those packets, and/or metadata relating to those packets, are passed to an aggregator, which is made available via an application program interface to users/applications.

Abstract: Systems and methods for performing customizable analysis of a communication session between two entities includes loading predetermined first parser definitions, stored as at least one binary file, receiving second parser definitions in a form other than a binary file form, after the first parser definitions are already operating, loading and compiling the second parser definitions, and applying the first and second parser definitions to a communication session, wherein the first parser definitions identify standard components of the communication session and the second parser definitions are customizable and identify non-standard components of the communication session.

Abstract: A system for and method of extracting information from multiple sessions of disparate protocols into a common language is disclosed. A method of creating a record conforming to an event-based language is also disclosed. A system configured to create a record conforming to an event-based language is also disclosed.

Abstract: A system for network security transparently occupies an observation port on the data stream, passing the entire range of network information to a dedicated interpreter. The interpreter resolves the data stream into individual data packets, which are then assembled into reconstructed network sessions according to parameters such as protocol type, source and destination addresses, source and destination ports, sequence numbers and other variables. The different types of sessions may include the traffic of many different types of users, such as e-mail, streaming video, voice-over-Internet and others. The system detects and stores the sessions into a database. A parser module may extract only the minimum information needed to reconstruct individual sessions. A backend interface permits a systems administrator to interrogate the forensic record of the network for maintenance, security and other purposes.

Abstract: A system for and method of extracting information from multiple sessions of disparate protocols into a common language is disclosed. A method of creating a record conforming to an event-based language is also disclosed. A system configured to create a record conforming to an event-based language is also disclosed.