Methods, systems and computer program products for monitoring usage of a server application

• US 20050188079A1
• Filed: 02/24/2004
• Published: 08/25/2005
• Est. Priority Date: 02/24/2004
• Status: Abandoned Application

• Current Assignee: Covelight Systems, Inc. (Radware Limited)
• Original Assignee: Covelight Systems, Inc. (Radware Limited)
• Inventors: Hargett, Byron Lee, Somerville, Garth Douglas, Hester, Douglas Wayne, Logan, David Byron, Motsinger, David Lee, Wall, Virgil Montgomery Jr., Gramley, Kenneth Robert, Choy, Albert Ming
• Application Number:
  US10/785,840
• Publication Number:
  US 20050188079A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods, systems and computer program products are disclosed for monitoring usage of a server application in a computer network. The methods, systems, and computer program products can monitor communication data between a server application and a client. The methods, systems, and computer program products can also include applying one or more detectors to the communication data to identify a variety of predetermined activity. Further, the methods, systems, and computer program products can include generating a threat score associated with the predetermined activity by comparing the identified predetermined activity with a security threshold criteria.

Claims

1. A method for monitoring server application activity, the method comprising:

(a) identifying a predetermined activity from communication data between a server application and a client over a predetermined time and generating an activity measurement; and

(b) comparing the identified activity to a predetermined measurement.

2. The method of claim 1, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

3. The method of claim 1, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

4. The method of claim 1, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

5. The method of claim 1, wherein the server application is implemented by a web server.

6. The method of claim 1, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

7. The method of claim 1, wherein the communication data comprises only transmission control protocol packets.

8. The method of claim 1, wherein the predetermined activity is a plurality of predetermined activities.

9. The method of claim 1, wherein the predetermined activity comprises a request by the client to the server application.

10. The method of claim 9, wherein the request is a count of the requests during the predetermined time interval.

11. The method of claim 9, comprising determining whether the request is greater than the predetermined measurement.

12. The method of claim 9, wherein if the request is greater than the predetermined measurement, alerting an operator.

13. The method of claim 1, wherein the request is a hypertext transfer protocol (HTTP) request.

14. The method of claim 1, wherein step (a) occurs repeatedly at a predetermined time interval.

15. The method of claim 14, wherein the predetermined time interval is about 30 seconds.

16. The method of claim 1, wherein the predetermined activity comprises a communication session between the server application and the client, and the predetermined activity is a time period for the session.

17. The method of claim 16, wherein step (a) comprises determining a time length for the communication session between the server application and the client.

18. The method of claim 17, wherein the predetermined activity is a predetermined time length.

19. The method of claim 18, wherein the predetermined time length is a first predetermined time length, and step (b) comprises determining whether the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.

20. The method of claim 19, comprising alerting an operator if the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.

60. The computer program product of claim 19, alerting an operator if the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.

21. A system for monitoring server application activity, the system comprising:

(a) a network interface operable to monitor communication data between a server application and a client; and

(b) a detector operable to identify a predetermined activity from communication data between a server application and a client over a predetermined time and generating an activity measurement, and operable to compare the identified activity to a predetermined measurement.

22. The system of claim 21, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

23. The system of claim 21, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

24. The system of claim 21, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

25. The system of claim 21, wherein the server application is implemented by a web server.

26. The system of claim 21, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

27. The system of claim 21, wherein the communication data comprises only transmission control protocol packets.

28. The system of claim 21, wherein the predetermined activity is a plurality of predetermined activities.

29. The system of claim 21, wherein the predetermined activity comprises a request by the client to the server application.

30. The system of claim 21, wherein the request is a hypertext transfer protocol (HTTP) request.

31. The system of claim 21, wherein the detector identifies the predetermined activity and generates the activity measurement repeatedly at a predetermined time interval.

32. The system of claim 31, wherein the predetermined time interval is about 30 seconds.

33. The system of claim 29, wherein the request is a count of the requests during the predetermined time interval.

34. The system of claim 29, wherein the detector is operable to determine whether the request is greater than the predetermined measurement.

35. The system of claim 29, comprising a user interface for alerting an operator if the request is greater than the predetermined measurement.

36. The system of claim 21, wherein the predetermined activity comprises a communication session between the server application and the client, and the predetermined activity is a time period for the session.

37. The system of claim 36, wherein the detector is operable to determine a time length for the communication session between the server application and the client.

38. The system of claim 37, wherein the predetermined activity is a predetermined time length.

39. The system of claim 38, wherein the predetermined time length is a first predetermined time length, and the detector is operable to determine whether the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.

40. The system of claim 39, comprising a user interface for alerting an operator if the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.

41. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) identifying a predetermined activity from communication data between a server application and a client over a predetermined time and generating an activity measurement; and

(b) comparing the identified activity to a predetermined measurement.

42. The computer program product of claim 41, wherein the communication data is communicated over a network selected from the group consisting of a global communication network, a wide area network, a local area network, and a wireless network.

43. The computer program product of claim 41, wherein the communication data comprises an application protocol selected from the group consisting of hypertext transfer protocols, simple object access protocols, web distributed authoring and versioning protocols, simple mail transfer protocols, wireless application protocols, file transfer protocols, Internet message access protocols, post office protocols, web services protocols, simple mail transfer protocols, structured hypertext transfer protocols, and web-mail protocols.

44. The computer program product of claim 41, wherein the communication data can comprise HTTP requests from the client and HTTP responses from the server application.

45. The computer program product of claim 41, wherein the server application is implemented by a web server.

46. The computer program product of claim 41, wherein the client is implemented by a web-enabled device including a unique Internet protocol (IP) address.

47. The computer program product of claim 41, wherein the communication data comprises only transmission control protocol packets.

48. The computer program product of claim 41, wherein the predetermined activity is a plurality of predetermined activities.

49. The computer program product of claim 41, wherein the predetermined activity comprises a request by the client to the server application.

50. The computer program product of claim 41, wherein the request is a hypertext transfer protocol (HTTP) request.

51. The computer program product of claim 41, wherein step (a) occurs repeatedly at a predetermined time interval.

52. The computer program product of claim 51, wherein the predetermined time interval is about 30 seconds.

53. The computer program product of claim 49, wherein the request is a count of the requests during the predetermined time interval.

54. The computer program product of claim 49, comprising determining whether the request is greater than the predetermined measurement.

55. The computer program product of claim 49, wherein if the request is greater than the predetermined measurement, alerting an operator.

56. The computer program product of claim 41, wherein the predetermined activity comprises a communication session between the server application and the client, and the predetermined activity is a time period for the session.

57. The computer program product of claim 56, wherein step (a) comprises determining a time length for the communication session between the server application and the client.

58. The computer program product of claim 57, wherein the predetermined activity is a predetermined time length.

59. The computer program product of claim 58, wherein the predetermined time length is a first predetermined time length, and step (b) comprises determining whether the difference between the time length for the communication session and the predetermined time length is greater than a second predetermined time length.