System and method to select and apply hypothetical mitigation parameters

• US 10,708,294 B2
• Filed: 01/19/2017
• Issued: 07/07/2020
• Est. Priority Date: 01/19/2017
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Northway, Jr., William M., Mortensen, Andrew D., Winquist, James E., Hay, Ronald G., Scott, Nicholas
• Primary Examiner(s): Kincaid, Kristine L
• Assistant Examiner(s): Lapian, Alexander R
• Application Number:
  US15/409,892
• Publication Number:
  US 20180205756A1
• Time in Patent Office: 1,265 Days
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method are provided to select mitigation parameters. The method includes receiving selection of at least one mitigation parameter, accessing a selected portion of stored network traffic or associated summaries that corresponds to a selectable time window, applying a mitigation to the selected portion of the stored network traffic or associated summaries using the selected at least one mitigation parameter, and outputting results of the applied mitigation.

Claims

1. A system to select mitigation parameters, the system comprising:

at least one packet intercept device coupled to a communication link in a computer network configured to make copies of packets of network traffic traversing in the computer network;

a flow collector device coupled to the at least one packet intercept device configured to generate flows records associated with received network traffic packets captured by the at least one packet intercept device;

a packet collector device coupled to the at least one packet intercept device configured to generate packet summaries associated with received network traffic packets captured by the at least one packet intercept device; and

a network analytics system coupled to each of the flow collector device and the packet collector device, including;

a memory configured to store instructions;

a processor disposed in communication with the memory, wherein the processor upon execution of the instructions is configured to;

provide a graphical user interface (GUI) that provides a plurality of interactive display elements that a user operates to select at least the following mitigation parameters;

     1) a filter definition for a filter to be applied;

     2) an attack traffic threshold value;

     3) a flow traffic threshold value; and

     4) a time window;

define first user selected mitigation parameters for mitigation application whereby a user through interaction with the GUI selects each of

     1) a filter definition for a filter to be applied;

     2) an attack traffic threshold value;

     3) a flow traffic threshold value; and

     4) a time window;

access a selected portion of stored network traffic for application of the first user selected mitigation parameters utilizing the generated flow records and packet summaries that corresponds to the user selected time window;

apply the first user selected mitigation parameters to the selected portion of the stored network traffic; and

output results of the applied first user selected mitigation parameters on the selected portion of the stored network traffic to be displayed on the GUI.

2. The system of claim 1, wherein the processor, upon execution of the instructions, is further configured to:

apply second user selected mitigation parameters to actual network traffic in real time; and

output results of the applied second user selected mitigation parameters via the GUI for comparison to displayed results of the applied first user selected mitigation parameters.

3. The system of claim 1, wherein defining user selected mitigation parameters includes receiving second user selected mitigation parameters that is different than the first user selected mitigation parameters, wherein the processor, upon execution of the instructions, is further configured to:

apply the second user selected mitigation parameters to the selected portion, or a different portion, of the stored network traffic; and

process, for display, output results of application of the mitigation and the second mitigation.

4. The system of claim 1, wherein the processor, upon execution of the instructions, is further configured to receive at least two time window selections, wherein:

accessing the selected portion of stored network traffic includes accessing a selected portion of the stored network traffic that applies to each of the time window selections, and

applying the first user selected mitigation parameters to the selected portion of the stored network traffic includes applying the first user selected mitigation parameters to each selected portion of the stored network traffic that corresponds to the respective at least two time window selections.

5. The system of claim 1, wherein the stored network traffic includes at least one of flow summaries, packet summaries, and captured data packets.

6. The system of claim 1, wherein the processor is further configured to:

receive hypothetical mitigation parameters;

receive actual mitigation parameters;

apply each of the received hypothetical and actual mitigation parameters to the stored network traffic such that the output results of the applied mitigation displays resulting network traffic from application of the hypothetical mitigation parameters superimposed with application of the actual mitigation parameters.