Method and system for monitoring network communications in real-time

• US 20040111507A1
• Filed: 12/05/2002
• Published: 06/10/2004
• Est. Priority Date: 12/05/2002
• Status: Abandoned Application

• Current Assignee: Michael Villado, Michelle Sitrin
• Original Assignee: Michael Villado, Michelle Sitrin
• Inventors: Villado, Michael, Sitrin, Michelle
• Application Number:
  US10/310,181
• Publication Number:
  US 20040111507A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method are provided for monitoring network communications in approximately real-time by capturing data that passes through a computer network and searching the data for at least one identification marker from a pre-determined set of identification markers. The information associated with the captured data is repackaged, viewed, and stored in a database. An authorized party may be provided with real-time alerts when predefined criteria are satisfied and the information may also be presented in reports that are organized and easy to read. As a result, the invention enables an authorized party to view pre-selected transactions in order to enforce Internet use policies.

Claims

1. A method of monitoring communication lines of a computer in approximately real-time, comprising:

monitoring data passing through the communication lines;

capturing data packets from the communication lines having at least one identification marker from a pre-determined set of identification markers;

repackaging the captured data packets;

organizing the repackaged data packets according to at least one predefined metric; and

enabling a user to configure at least one feature for each of the at least one predefined metric.

2. The method according to claim 1, wherein said capturing the data packets having the at least one identification marker from the pre-determined set of identification markers includes selecting data packets structured as one of at least a transmission control protocol and a user datagram protocol.

3. The method according to claim 1, wherein said monitoring data packets includes monitoring in real-time for an identification marker identifying at least one of an e-mail transaction, a file transfer protocol transaction, a web usage transaction, a chat usage transaction, and an instant messaging transaction.

4. The method according to claim 1, wherein the at least one predefined metric for viewing the repackaged data packets is defined to be at least one of a file transfer protocol usage transaction, an e-mail usage transaction, a web usage transaction, a chat usage transaction, and an all transmission control protocol transaction.

5. The method according to claim 4, wherein the at least one predefined metric for viewing the repackaged data packets is represented as at least one dial indicating a number of corresponding transactions passing through the communication lines.

6. The method according to claim 1, wherein the repackaged data packets are organized into at least one of a file transfer protocol usage transaction, an e-mail usage transaction, a web usage transaction, a chat usage transaction, and an all transmission control protocol transaction.

7. The method according to claim 1, wherein the user configures at least one monitoring feature for each of the at least one predefined metric.

8. The method according to claim 7, wherein the at least one monitoring feature includes at least one of a real-time window, a set-up window, and an alarm window.

9. The method according to claim 8, wherein each of the at least one of the real-time window, the set-up window, and the alarm window is different for each of the at least one metric.

10. The method according to claim 9, wherein each of the at least one of the real-time window, the set-up window, and the alarm window is displayed as pop-up window that enables the user to define one or more monitoring events.

11. The method according to claim 1, wherein the user configures a notification feature for each of the at least one predefined metric.

12. The method according to claim 11, wherein the notification feature includes at least a reports and alerts window.

13. The method according to claim 12, wherein the reports and alerts window is configured to automatically send an alert to an authorized user.

14. The method according to claim 13, wherein the alert is sent to the authorized user through at least one of an instant e-mail alert, an instant facsimile alert, a pager, and a cellular telephone.

15. The method according to claim 1, wherein the data packets are repackaged in real-time and transferred to a database for storage.

16. The method according to claim 1, wherein the data packets that correspond to the pre-determined set of identification markers are stored in a database, while the data packets that do not correspond to the pre-determined set of identification markers are not stored in the database.

17. A network communication monitoring system, comprising:

a first application server that is adapted to be coupled to a plurality of terminal devices for processing requests sent by the terminal devices;

a second application server that is coupled to the first application server and to an external source through communication lines, the second application server having one or more modules comprising;

a first module that monitors data passing through the communication lines in approximately real-time;

a second module that captures data packets from the communication lines having at least one identification marker from a pre-determined set of identification markers;

a third module that repackages the captured data packets;

a fourth module that organizes the repackaged data packets according to at least one predefined metric; and

a fifth module that enables a user to configure at least one feature for each of the at least one predefined metric.

18. The network communication monitoring system according to claim 17, wherein the second application server is located at a network side of the first application server.

19. The network communication monitoring system according to claim 17, further comprising a data base coupled to the second application server.

20. The network communication monitoring system according to claim 17, wherein the second module is adapted to store the data packets having at least one identification marker from the pre-determined set of identification markers and to discard the data packets that do not have at least one identification marker from the pre-determined set of identification markers.

21. The network communication monitoring system according to claim 19, wherein the second module is adapted to store the data packets having at least one identification marker from the pre-determined set of identification markers corresponding to at least one of a file transfer protocol transaction, an e-mail transaction, a web usage transaction, a chat usage transaction, and an all transmission control protocol transaction.

22. The network communication monitoring system according to claim 17, wherein the external source is an Internet.

23. The network communication monitoring system according to claim 22, wherein at least one identification marker from the pre-determined set of identification markers correspond to codes defining an Internet transaction.

24. An application server comprising:

a first module that monitors data passing through communication lines in approximately real-time;

a second module that captures data packets from the communication lines having at least one identification marker from a pre-determined set of identification markers;

a third module that repackages the captured data packets;

a fourth module that organizes the repackaged data packets according to at least one predefined metric; and

a fifth module that enables a user to configure at least one feature for each of the at least one predefined metric.

25. The network communication monitoring system according to claim 24, further comprising a database coupled to the application server.

26. The network communication monitoring system according to claim 24, wherein the second module is adapted to store the data packets having at least one identification marker from the pre-determined set of identification markers and to discard the data packets that do not have at least one identification marker from the pre-determined set of identification markers.

27. The network communication monitoring system according to claim 25, wherein the second module is adapted to store the data packets having at least one identification marker from the pre-determined set of identification markers corresponding to at least one of a file transfer protocol transaction, an e-mail transaction, a web usage transaction, a chat usage transaction, and an all transmission control protocol transaction.

28. A computer program product for enabling a computer to monitor data passing through a computer network, comprising:

software instructions for enabling the computer to perform predetermined operations;

a computer readable medium bearing the software instructions;

the predetermined operations comprising;

monitoring data passing through communication lines of the computer network in approximately real-time;

capturing data packets from the communication lines having at least one identification marker from a pre-determined set of identification markers;

repackaging the captured data packets;

organizing the repackaged data packets according to at least one predefined metric; and

enabling a user to configure at least one feature for each of the at least one predefined metric.

29. The computer program product according to claim 28, wherein the user configures a monitoring feature for each of the at least one predefined metric.

30. The computer program product according to claim 28, wherein the user configures a notification feature for each of the at least one predefined metric.

31. The computer program product according to claim 30, wherein the user configures the notification feature to automatically or manually send an alert to an authorized user.

32. A data transmission medium between a client and a server containing a data structure for monitoring data passing through the server, wherein the data structure includes instructions for enabling a computer to perform predetermined operations comprising:

monitoring data passing through communication lines of the computer network in approximately real-time;

capturing data packets from the communication lines having at least one identification marker from a pre-determined set of identification markers;

repackaging the captured data packets;

organizing the repackaged data packets according to at least one metric; and

enabling a user to configure at least one feature for each of the at least one metric.