Server resource management, analysis, and intrusion negation

• US 20040093512A1
• Filed: 11/08/2002
• Published: 05/13/2004
• Est. Priority Date: 11/08/2002
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Federal Network Systems LLC (Jacobs Solutions, Inc.)
• Inventors: Sample, Char
• Granted Patent: US 7,353,538 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A console host and intrusion negation system (CHAINS) includes a host component [202] and a console component [203]. The host component [202] monitors resources at a server [501-503]. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Claims

1. A method for managing resources, comprising:

monitoring a plurality of resources associated with a network server;

comparing activity levels of the plurality of resources to predetermined threshold activity levels; and

reducing usage of one of the plurality of resources when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level associated therewith.

2. The method of claim 1, wherein monitoring a plurality of resources further includes:

determining an activity level at a communication interface of the network server.

3. The method of claim 2, wherein determining an activity level at the communication interface includes keeping track of a number of open network connections.

4. The method of claim 2, wherein monitoring a plurality of resources further includes:

determining usage of a memory associated with the network server.

5. The method of claim 4, wherein monitoring a plurality of resources further includes:

determining usage of a processor of the network server.

6. The method of claim 5, wherein monitoring a plurality of resources further includes:

determining capacity of a hard disk drive associated with the network server.

7. The method of claim 1, further comprising:

alerting a user when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level.

8. The method of claim 7, wherein alerting the user includes transmitting an alert to a remote computer.

9. The method of claim 1, wherein the predetermined threshold activity levels are set by a user from a remote computer.

10. A computer server comprising:

at least one processor;

a communication interface; and

a memory containing instructions that when executed by the at least one processor cause the processor to;

monitor a usage level of the communication interface, the memory, and at least one of the at least one processor;

compare the usage level of the communication interface to a first threshold and throttle back a number of active network connections when the usage level of the communication interface is greater than the first threshold;

compare the usage level of the memory to a second threshold and shut down inactive processes when the usage level of the memory is above the second threshold; and

compare the usage level of the monitored processor to a third threshold and shut down inactive processes when the usage level of the monitored processor is above the third threshold.

11. The computer server of claim 10, further comprising:

a magnetic storage device, wherein

the memory contains additional instructions that when executed by the processor cause the processor to;

compare the usage level of the magnetic storage device to a fourth threshold and compress files on the magnetic storage device when the usage level of the magnetic storage device is above the fourth threshold.

12. The computer server of claim 10, wherein the first, second, and third thresholds are set remotely.

13. The computer server of claim 10, wherein the memory contains additional instructions that when executed by the processor cause the processor to transmit a resource alert to a remote computer.

14. A system comprising:

a plurality of first computing devices, each of the plurality of first computing devices including a corresponding host software component configured to monitor resources of the corresponding first computing device and throttle back resource usage when resources of the corresponding first computing device are being used above predetermined threshold levels; and

a second computing device including a console software component configured to display alerts when the resources of the first computing device are being used above the predetermined threshold levels.

15. The system of claim 14, wherein when the second computing device receives alerts from multiple ones of the first computing devices at approximately a same time, outputting information describing a possible denial of service attack.

16. The system of claim 14, wherein the monitored resources include at least one of a communication interface, a processor, a disk drive, and computer random access memory.

17. The system of claim 14, wherein the second computing device transmits the predetermined threshold levels to the first computing device.

18. The system of claim 14, wherein the second computing device is located remotely from the first computing device.

19. The system of claim 14, wherein the first computing devices are network servers.

20. A computer-readable medium containing instructions that when executed by a processor cause the processor to:

monitor a plurality of resources associated with a network server;

compare activity levels of the plurality of resources to predetermined threshold activity levels; and

reduce usage of one of the plurality of resources when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level associated with the one of the plurality of resources.

21. The computer-readable medium of claim 20, further comprising instructions that when executed by the processor cause the processor to:

alert a user when usage of the one of the plurality of resources increases above the predetermined threshold activity level.

22. The computer-readable medium of claim 20, wherein alerting the user includes transmitting an alert to a remote computer.

23. A computer-readable medium of claim 20, wherein the predetermined threshold activity levels are set by a user from a remote computer.

24. A method for managing resources comprising:

displaying information relating to resources of a plurality of remote computers;

receiving information defining threshold levels for the resources at the plurality of remote computers; and

transmitting the information defining the threshold levels for the resources to the plurality of remote computers, wherein

the remote computers throttle back resource usage when a resource usage level exceeds the threshold levels.

25. The method of claim 24, wherein when multiple ones of the remote computer resources exceeds the threshold level at approximately a same time, outputting information describing a possible attack.

26. The method of claim 24, wherein the remote computers are network servers.

27. The method of claim 24, wherein the resources of the remote computers include at least one of a communication interface, a processor, a disk drive, and computer random access memory.

28. A device comprising:

means for displaying information relating to resources of a plurality of remote computers;

means for receiving information defining threshold levels for the resources at the plurality of remote computers; and

means for transmitting the information defining the threshold levels for the resources at the plurality of remote computers, wherein

the remote computers throttle back resource usage when a resource usage level exceeds the threshold levels.