Efficient Extraction of Network Event Types from NetFlows

Algorithm 6

Heuristic driven flow subset with limited average search.

1: function SUBSETSEARCH(formula_avg, Flows)

2:  flows sort(flows, flows.Bytes)           optional pre-sorting

3:  while flows   do

4:   if avg(flows.Bytes)     formula_avg.range then

5:    flow  min(flows, flows.Bytes)

6:    flows    flows    flow

7:   else if avg(flows.Bytes)  formula_avg.range then

8:   flow max(flows, flows.Bytes)

9:   flows   flows    flow

10:   else

11:   break

12:   end if

13: end while

14: return flows

15: end function