Security camera for a network

• US 20040015582A1
• Filed: 06/23/2003
• Published: 01/22/2004
• Est. Priority Date: 05/12/2000
• Status: Active Grant

• Current Assignee: Niksun, Inc.
• Original Assignee: Parag Pruthi
• Inventors: Pruthi, Parag
• Granted Patent: US 8,275,875 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0858 One way delays
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/108 : when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers

Abstract

A method for processing data from a communication line. Data is received from the communication line (802) and segregated into packets (803). Packets are selected based on a respective characteristic (804) and the selected packets are provided to one of a plurality of data processing units.

Claims

1. A method for processing data on a communication line comprising the steps of.

(a) receiving the data from the communication line;

(b) segregating the data into the packets;

(c) selecting packets based on a respective characteristic;

(d) providing the selected packets to one of a plurality of data processing units.

2. A method according to claim 1 wherein step (c) includes selecting packets corresponding to a session.

3. A method according to claim 1 wherein step (c) includes selecting packets based on at lease one of a source address, a destination address, an autonomous system a source port, a destination port, a network identifier and a pair of hosts.

4. A method according to claim 2 wherein step (d) includes providing the selected packets to one of a plurality of intrusion detection devices.

5. A method according to claim 1 further comprising the step of encrypting the selected packets before step (d).

6. A method according to claim 1 wherein step (c) cases selecting packets based on a respective type.

7. A method according to claim 1 further comprising the step of storing the segregated packets and step (c) includes selecting stored packets based on a respective characteristic.

8. A method according to claim 1 wherein step (a) includes receiving data under a first protocol and step (d) includes providing the selected packets under a second protocol different from the first protocol.

9. A method for processing data on a communication line comprising the steps of:

(a) receiving the data from the communication line;

(b) segregating the data into packets;

(c) selecting packets based on a respective characteristic;

(d) generating a statistic corresponding to the selected packets;

(e) generating a threshold based on historical values of the statistic;

(e) generating an alarm signal if the statistic exceeds the threshold.

10. A method according to claim 9 wherein the statistic corresponds to the number of packets of differ users received from one source address.

11. A method according to claim 9 wherein the statistic corresponds to the number of packets received for modifying a key file.

12. A method according to claim 9 wherein the statistic corresponds to the number of host pair connections involving a common source or destination address.

13. A method according to claim 9 wherein the statistic corresponds to a packet rate corresponding to a host pair.

14. A method according to claim 9 wherein the statistic corresponds to the individual sessions corresponding to a host.

15. A method according to claim 9 wherein the statistic corresponds the utilization of the communication line over a given period of time.

16. A method according to claim 9 wherein the statistic corresponds to a number of invalid source or donation addresses.

17. A system for monitoring communication on a network, the system Comprising:

a plurality of network monitors coupled to receive data from their respective communication lines;

a management module coupled to each of the plurality of network monitors for receiving at least one of the received data and statistics corresponding to the received data from at least one of the plurality of network monitors.

18. A method for collecting and analyzing data transmitted on a network comprising the steps of:

(a) receiving data from a first communication line;

(b) segregating the data from the first communication line into packets;

(c) receiving data from a second communication line;

(d) segregating the data from the second communication line into packets;

(e) providing at least one of selected packets from the first communication line and statistics corresponding to the selected packets from the first communication line to a central management module;

(f) providing at least one of selected packets from the second communication line and statistics corresponding to the selected packets from the second communication line to a central management module.