Method and system for configuring behavioral network intelligence system using network monitoring programming language

• US 10,374,918 B2
• Filed: 12/04/2014
• Issued: 08/06/2019
• Est. Priority Date: 12/04/2013
• Status: Active Grant

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: Medvedovsky, Lev, Aviv, David, Chesla, Avi
• Primary Examiner(s): Nilsson, Eric
• Application Number:
  US14/560,872
• Publication Number:
  US 20150154494A1
• Time in Patent Office: 1,706 Days
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0894 Packet rate

Abstract

A method and system for configuring a behavioral network intelligence system using a network monitoring programming language are provided. The method includes defining at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined respective of an application path keyword and an application path assessment keyword; and defining at least one condition representing the behavior of the at least one application path attribute of the application, the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network.

Claims

1. A method for configuring a behavioral network intelligence system using a network monitoring programming language, comprising:

defining at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined for an application path keyword and an application path assessment keyword;

defining at least one condition representing the behavior of the at least one application path attribute of the application, wherein the at least one condition is defined using a plurality of terms and Boolean expressions, each of the plurality of terms is defined for a behavior keyword and a behavior keyword assessment;

parsing the at least one target and the at least one condition to generate a list of entities; and

instantiating a plurality of inference modules based on the parsing of the at least one target and the at least one condition;

wherein the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network carrier.

2. The method of claim of 1, wherein the at least one application path attribute and the at least one condition comply with a syntax of the network monitoring programming language.

3. The method of claim 2, wherein the behavior keyword, the behavior keyword assessment, the application path keyword, and the application path assessment keyword are defined by the syntax of the network monitoring programming language.

4. The method of claim 2, wherein the behavior keyword assessment is any one of:

high, low, and normal.

5. The method of claim 2, wherein the application path keyword assessment is any one of:

a specific number, a specific label, a list of numbers, a list of labels, ‘

all’

, and ‘

any’

.

6. The method of claim 2, wherein the application path keyword relates to an application path attribute including any one of:

an application name, a device type, an operating system type, an operating system version, a geographical location, a browser type, an application type, and an application version.

7. The method of claim 2, wherein the behavior keyword relates to a behavioral parameter including any one of:

a packet rate, a byte rate, a data direction, a plurality of new connections per second (CPS), a concurrent number of connections per application (CUC), a connection duration, and a transport protocol state.

8. The method of claim 1, further comprising:

evaluating using the inference modules at least a degree of fulfillment (DoF), wherein the DoF defines a behavior group that the plurality of terms satisfy with respect to the at least one target.

9. The method of claim 8, wherein evaluating the at least a DoF further comprises:

for each of the plurality terms;

sampling, at predefined time intervals, data of behavioral parameters related to behavior keywords defined in the term;

computing behavioral scores using the sampled data and the behavior keyword assessment; and

correlating the computed behavioral scores using the plurality of terms and Boolean expressions to generate the at least one DoF.

10. The method of claim 8, wherein the behavior group defines any one of:

variance of chatty activity, variance of malware activity, and variance of scanning activity.

11. The method of claim 1, wherein the at least one condition is dynamically changed.

12. The method of claim 1, wherein the network monitoring programming language is a human linguistics programming language.

13. The method of claim 1, wherein the method is implemented in a central controller of a software defined network (SDN), wherein the SDN further comprises a plurality of network elements, and wherein the SDN is part of an infrastructure of a network carrier.

14. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1.

15. A system for determining the behavioral impact of applications on a network, comprising:

a processor; and

a memory communicatively connected to the processor, the memory containing a plurality of instructions that, when executed by the processor, configure the system to;

define at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined for an application path keyword and an application path assessment keyword;

define at least one condition representing the behavior of the at least one application path attribute of the application, wherein the at least one condition is defined using a plurality of terms and Boolean expressions, each of the plurality of terms is defined for a behavior keyword and a behavior keyword assessment;

parse the at least one target and the at least one condition to generate a list of entities; and

instantiate a plurality of inference modules based on the parsing of the at least one target and the at least one condition;

wherein the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network.

16. The system of claim of 15, wherein the at least one application path attribute and the at least one condition comply with a syntax of the network monitoring programming language.

17. The system of claim 16, wherein the behavior keyword, the behavior keyword assessment, the application path keyword, and the application path assessment keyword are reserved words of the network monitoring programming language.

18. The system of claim 16, wherein the behavior keyword assessment is any one of:

high, low, and normal.

19. The system of claim 16, wherein the application path keyword assessment is any one of:

a specific number, a specific label, a list of numbers, a list of labels, ‘

all’

, and ‘

any’

.

20. The system of claim 16, wherein the application path keyword relates to an application path attribute including any one of:

an application name, a device type, an operating system type, an operating system version, a geographical location, a browser type, an application type, and an application version.

21. The system of claim 16, wherein the behavior keyword relates to a behavioral parameter including any one of:

a packet rate, a byte rate, a data direction, a plurality of new connections per second (CPS), a concurrent number of connections per application (CUC), a connection duration, and a transport protocol state.

22. The system of claim 15, wherein the system is further configured to:

evaluate, using the interference modules, at least a degree of fulfillment (DoF), wherein the DoF defines a behavior group that the plurality of terms satisfy with respect to the at least one target.

23. The system of claim 22, wherein the system is further configured to:

for each of the plurality terms;

sample, at predefined time intervals, data of behavioral parameters related to behavior keywords defined in the term; and

compute behavioral scores using the sampled data and the behavior keyword assessment,

correlate the computed behavioral scores using the plurality of terms and Boolean expressions to generate the at least one DoF.

24. The system of claim 22, wherein the behavior group defines any one of:

variance of chatty activity, variance of malware activity, and variance of scanning activity.

25. The system of claim 15, wherein the at least one condition is dynamically changed.

26. The system of claim 15, wherein the network monitoring programming language is a human linguistics programming language.