Network bandwidth anomaly detector apparatus, method, signals and medium

• US 20040114519A1
• Filed: 11/28/2003
• Published: 06/17/2004
• Est. Priority Date: 12/13/2002
• Status: Abandoned Application

• Current Assignee: Cetacea Networks Corporation
• Original Assignee: Cetacea Networks Corporation
• Inventors: MacIsaac, Gary Lorne
• Application Number:
  US10/722,423
• Publication Number:
  US 20040114519A1
• Time in Patent Office: Days
• US Class Current: 370/232
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method of detecting bandwidth anomalies in a communication system involves receiving a first traffic waveform representing a time distribution of data volume in a first direction in the data communication system in a first period of time, producing a correlation value representing a correlation of the first traffic waveform with a reference waveform, and producing a bandwidth anomaly signal when the correlation value satisfies a criterion.

Claims

1. A method of detecting bandwidth anomalies in a data communication system, the method comprising:

receiving a first traffic waveform representing a time distribution of data volume in a first direction in said data communication system in a first period of time;

producing a correlation value representing a correlation of said first traffic waveform with a reference waveform; and

producing a bandwidth anomaly signal when said correlation value satisfies a criterion.

2. The method of claim 1 wherein producing said bandwidth anomaly signal comprises producing said denial of service attack signal when said correlation value is less than a reference value.

3. The method of claim 2 wherein producing said bandwidth anomaly signal comprises determining whether said correlation value is less than said reference value.

4. The method of claim 1 further comprising receiving a second traffic waveform representing a time distribution of data volume in a second direction on said data communication system in a second period of time, and using said second traffic waveform as said reference waveform to produce said correlation value.

5. The method of claim 1 further comprising generating said first traffic waveform in response to a first set of traffic measurement values.

6. The method of claim 5 wherein generating said first traffic waveform comprises subjecting said first set of traffic measurement values to a Discrete Wavelet Transform.

7. The method of claim 6 wherein subjecting said first set of traffic measurement values to said Discrete Wavelet Transform comprises using Haar wavelet filter coefficients in said Discrete Wavelet Transform.

8. The method of claim 6 wherein generating said first traffic waveform comprises causing said Discrete Wavelet Transform to produce a first component, said first component representing said first traffic waveform.

9. The method of claim 8 wherein producing said correlation value comprises correlating said first component with said reference waveform.

10. The method of claim 8 further comprising using a processor circuit to generate said first traffic waveform and to correlate said first traffic waveform with said reference waveform.

11. The method of claim 1 wherein said first traffic waveform represents a statistical measure of a time distribution of data volume in said first direction.

12. The method of claim 5 further comprising monitoring data in said first direction and producing said first set of traffic measurement values in response thereto.

13. The method of claim 12 wherein producing said first set of traffic measurement values comprises producing values representing a property of an Ethernet statistics group in a remote monitoring protocol.

14. The method of claim 13 further comprising causing a processor circuit operable to produce said first traffic waveform to communicate with a communication interface to receive said values representing said property of an Ethernet statistics group.

15. The method of claim 12 wherein monitoring said data in said first direction comprises at least one of:

counting packets and counting octets, in said first direction.

16. The method of claim 15 further comprising causing a processor circuit operable to produce said first traffic waveform to communicate with at least one of a packet counter and an octet counter to receive values representing said first set of traffic measurement values.

17. The method of claim 16 further comprising causing said processor circuit to implement at least one of said packet counter and said octet counter.

18. The method of claim 12 further comprising passively monitoring said data in said first direction.

19. A data communication method comprising transmitting and receiving data from a data communication system, the data communication system method of claim 12 and further comprising signaling an operator in response to said bandwidth anomaly signal.

20. A data communication method comprising transmitting and receiving data from a data communication system, the data communication system method of claim 12 and further comprising controlling at least one of transmission and reception of data from said data communication system in response to said bandwidth anomaly signal.

21. The method of claim 4 further comprising generating said first and second traffic waveforms in response to first and second sets of traffic measurement values, representing traffic in said first and second directions on said data communication system, respectively.

22. The method of claim 21 wherein receiving said first and second traffic waveforms comprises receiving first and second waveforms representing first and second statistical measures of first and second time distributions respectively of data volume in first and second directions in said data communications system.

23. The method of claim 21 wherein generating said first and second traffic waveforms comprises subjecting said first and second sets of traffic measurement values respectively, to a Discrete Wavelet Transform.

24. The method of claim 23 wherein subjecting said first and second sets of traffic measurement values to said Discrete Wavelet Transform comprises using Haar wavelet filter coefficients in said Discrete Wavelet Transform.

25. The method of claim 23 further comprising causing said Discrete Wavelet Transform to produce a first component, representing said first traffic waveform and a second component representing said second traffic waveform.

26. The method of claim 25 wherein producing said correlation value comprises correlating said first and second components.

27. The method of claim 25 further comprising implementing a traffic waveform generator in a processor circuit used to produce said correlation value.

28. The method of claim 21 further comprising monitoring data in said first and second directions and producing said first and second sets of traffic measurement values respectively in response thereto.

29. The method of claim 28 wherein producing said first and second sets of traffic measurement values comprises producing values representing a property of an Ethernet statistics group in a remote monitoring protocol, for each of said first and second directions.

30. The method of claim 29 further comprising causing a processor circuit operable to produce said first and second traffic waveforms to communicate with a communication interface to receive said values representing a property of an Ethernet statistics group.

31. The method of claim 28 wherein monitoring said data comprises at least one of:

packet counters and octet counters in each of said first and second directions.

32. The method of claim 28 further comprising causing a processor circuit operable to produce said first and second traffic waveforms to communicate with at least one of a packet counter and an octet counter to receive values representing said first and second sets of traffic measurement values.

33. The method of claim 32 further comprising causing said processor circuit to implement at least one of said packet counter and said octet counter.

34. The method of claim 28 further comprising passively monitoring said data in said first and second directions.

35. A data communication method comprising transmitting and receiving data from a data communication system, the data communication method of claim 1 and further comprising signaling an operator in response to said bandwidth anomaly signal.

36. A data communication method comprising transmitting and receiving data from a data communication system, the data communication method of claim 1 and further comprising controlling at least one of the transmission and reception of data from said data communication system in response to said bandwidth anomaly signal.

37. An apparatus for detecting bandwidth anomalies in a data communication system, the apparatus comprising:

means for receiving a first traffic waveform representing a time distribution of data volume in a first direction in said data communication system in a first period of time;

means for producing a correlation value representing a correlation of said first traffic waveform with a reference waveform; and

means for producing a bandwidth anomaly signal when said correlation value satisfies a criterion.

38. A computer readable medium encoded with codes for directing a processor circuit to detect bandwidth anomalies in a data communication system, by:

receiving a first traffic waveform representing a time distribution of data volume in a first direction in said data communication system in a first period of time;

producing a correlation value representing a correlation of said first traffic waveform with a reference waveform; and

producing a bandwidth anomaly signal when said correlation value satisfies a criterion.

39. A computer readable signal encoded with codes for directing a processor circuit to detect bandwidth anomalies in a data communication system, by:

receiving a first traffic waveform representing a time distribution of data volume in a first direction in said data communication system in a first period of time;

producing a correlation value representing a correlation of said first traffic waveform with a reference waveform; and

producing a bandwidth anomaly signal when said correlation value satisfies a criterion.

40. An apparatus for detecting bandwidth anomalies in a data communication system, the apparatus comprising:

a processor circuit configured to;

receive a first traffic waveform representing a time distribution of data volume in a first direction in said data communication system in a first period of time;

produce a correlation value representing a correlation of said first traffic waveform with a reference waveform; and

produce a bandwidth anomaly signal when said correlation value satisfies a criterion.

41. The apparatus of claim 40 wherein said processor circuit is configured to produce said bandwidth anomaly signal when said correlation value is less than a reference value.

42. The apparatus of claim 41 wherein said processor circuit is configured to determine whether said correlation value is less than said reference value.

43. The apparatus of claim 40 wherein said processor circuit is configured to receive a second traffic waveform representing a statistical measure of a time distribution of data volume in a second direction on said data communication system in a second period of time, and use said second traffic waveform as said reference waveform to produce said correlation value.

44. The apparatus of claim 40 further comprising a first traffic waveform generator operable to receive a first set of traffic measurement values and to produce said first traffic waveform in response thereto.

45. The apparatus of claim 44 wherein said first traffic waveform generator is configured to produce said first traffic waveform by subjecting said first set of traffic measurement values to a Discrete Wavelet Transform.

46. The apparatus of claim 45 wherein said first traffic waveform generator is configured to use Haar wavelet filter coefficients in said Discrete Wavelet Transform.

47. The apparatus of claim 45 wherein said first traffic waveform generator is configured to cause said Discrete Wavelet Transform to produce a first component, said first component representing said first traffic waveform.

48. The apparatus of claim 47 wherein said processor circuit is configured to produce said correlation value by correlating said first component with said reference waveform.

49. The apparatus of claim 44 wherein said processor circuit is configured to implement said first traffic waveform generator.

50. The apparatus of claim 40 wherein said first traffic waveform represents a statistical measure of a time distribution of data volume in said first direction.

51. The apparatus of claim 44 further comprising a communication interface operable to monitor data in said first direction and to produce said first set of traffic measurement values in response thereto.

52. The apparatus of claim 51 wherein said communication interface produces values representing a property of an Ethernet statistics group in a remote monitoring protocol.

53. The apparatus of claim 52 wherein said processor circuit is configured to communicate with said communication interface to receive said values representing a property of an Ethernet statistics group, said values representing said first set of traffic measurement values.

54. The apparatus of claim 51 wherein said communication interface includes at least one of a packet counter and an octet counter operable to count a corresponding one of packets and octets of data in said first direction.

55. The apparatus of claim 54 wherein said processor circuit is configured to communicate with said communication interface to receive values produced by at least one of a said packet counter and said octet counter, said values representing said first set of traffic measurement values.

56. The apparatus of claim 55 wherein said processor circuit is configured to implement said communication interface.

57. The apparatus of claim 51 further comprising a passive monitor operable to passively monitor said data in said first direction and to provide a copy of said data in said first direction to said communication interface.

58. A data communication apparatus operable to transmit and receive data from a data communication system, the data communication apparatus comprising the apparatus of claim 51 and further comprising a signaling device for signaling an operator in response to said bandwidth anomaly signal.

59. A data communication apparatus operable to transmit and receive data from a data communication system, the data communication apparatus comprising the apparatus of claim 51 and further comprising a communication control device for controlling at least one of the transmission and reception of data from said data communication system in response to said bandwidth anomaly signal.

60. The apparatus of claim 43 further comprising a traffic waveform generator operable to receive said first and second sets of traffic measurement values and to produce said first and second traffic waveforms in response thereto.

61. The apparatus of claim 60 wherein said processor is configured to receive first and second traffic waveforms representing first and second statistical measures of first and second time distributions respectively of data volume in first and second directions in said data communications system.

62. The apparatus of claim 60 wherein said traffic waveform generator is configured to produce said first and second traffic waveforms by subjecting said first and second sets of traffic measurement values respectively, to a Discrete Wavelet Transform.

63. The apparatus of claim 62 wherein said traffic waveform generator is configured to use Haar wavelet filter coefficients in said Discrete Wavelet Transform.

64. The apparatus of claim 62 wherein said traffic waveform generator is configured to cause said Discrete Wavelet Transform to produce a first component, representing said first traffic waveform and a second component representing said second traffic waveform.

65. The apparatus of claim 64 wherein said processor circuit is configured to produce said correlation value by correlating said first and second components.

66. The apparatus of claim 64 wherein said processor circuit is configured to implement said traffic waveform generator.

67. The apparatus of claim 60 further comprising a communication interface operable to monitor data in said first and second directions and to produce said first and second sets of traffic measurement values respectively in response thereto.

68. The apparatus of claim 67 wherein said communication interface produces values representing a property of an Ethernet statistics group in a remote monitoring protocol, for each of said first and second directions.

69. The apparatus of claim 68 wherein said processor circuit is configured to communicate with said communication interface to receive said values representing a property of an Ethernet statistics group, for each of said first and second directions, said values representing said first and second sets of traffic measurement values respectively.

70. The apparatus of claim 67 wherein said communication interface includes at least one of a packet counter and an octet counter operable to count a corresponding one of packets and octets of data for each of said first and second directions.

71. The apparatus of claim 67 wherein said processor circuit is configured to communicate with said communication interface to receive values produced by at least one of said packet counter and said octet counter, said values representing said first and second sets of traffic measurement values.

72. The apparatus of claim 67 wherein said processor circuit is configured to implement said communication interface.

73. The apparatus of claim 67 further comprising a passive monitor operable to passively monitor said data in said first and second directions and to provide copies of said data to said communication interface.

74. A data communication apparatus operable to transmit and receive data from a data communication system, the data communication apparatus comprising the apparatus of claim 40 and further comprising a signaling device for signaling an operator in response to said bandwidth anomaly signal.

75. A data communication apparatus operable to transmit and receive data from a data communication system, the data communication apparatus comprising the apparatus of claim 40 and further comprising a communication control device for controlling at least one of the transmission and reception of data from said data communication system in response to said bandwidth anomaly signal.