Efficient Extraction of Network Event Types from NetFlows

Algorithm 4

Expansion of flows into version space.

1: flowWindows DistributeFlows(Flows)

2: descriptions ParseDescriptions(Descriptions, Dictionary)

3: versionSpace

4:

5: procedure EXPANDVERSIONSPACE                 flow processing

6:  for all flowWindow    flowWindows do

7:   for all flow    flowWindow do

8:    for all flowSpec    descriptions.f lowSpec do

9:     for all formula    flowSpec do

10:      if flow formula then

11:        break

12:      end if

13:     end for

14:     hashKey CreateKey(flow,flowSpec)            hashing the flow

15:     if hashKey    versionSpace.Keys then

16:      protoEvent (versionSpace hashKey)

17:      protoEvent.Flows protoEvent.Flows    flow           add flow

18:     else

19:     protoEvent                 create new proto-event

20:      protoEvent protoEvent.Flows    flow

21:      versionSpace versionSpace    (hashKey   protoEvent)

22:     end if

23:   end for

24:  end for

25: end for

26: end procedure