System, computer-usable medium and method for monitoring network activity
First Claim
1. A system, coupled to a network, the system comprising:
- a collection module for collecting a stream of flow records from an observation point within the network, wherein the stream of flow records is collected in accordance with a first set of configuration parameters;
a statistical module for generating a statistical result from the stream of flow records as each flow record is collected, wherein the statistical result is generated in accordance with a second set of configuration parameters;
an analysis module for analyzing the statistical result to monitor network activity associated with the observation point, wherein the statistical result is analyzed in accordance with a third set of configuration parameters; and
wherein the first, second, and third sets of configuration parameters can be modified at any time, after abnormal activity is detected by the analysis module, to alter a magnification level by which a subset of the network activity is subsequently monitored.
1 Assignment
0 Petitions
Accused Products
Abstract
A system couples to a network and monitors activity thereon. The system comprises one or more capture modules. Each capture module comprises a collection, statistical, and analysis modules. The collection module collects flow records from an observation point within the network, wherein the flow records are collected per a first set of configuration parameters. The statistical module generates a statistical result from the flow records as each flow record is collected, wherein the statistical result is generated per a second set of configuration parameters. The analysis module analyzes the statistical result to monitor network activity associated with the observation point, wherein the statistical result is analyzed per a third set of configuration parameters. The first, second and third sets of configuration parameters can generally be modified at any time, after abnormal activity is detected, to alter a magnification level by which a subset of the network activity is monitored.
199 Citations
28 Claims
-
1. A system, coupled to a network, the system comprising:
-
a collection module for collecting a stream of flow records from an observation point within the network, wherein the stream of flow records is collected in accordance with a first set of configuration parameters;
a statistical module for generating a statistical result from the stream of flow records as each flow record is collected, wherein the statistical result is generated in accordance with a second set of configuration parameters;
an analysis module for analyzing the statistical result to monitor network activity associated with the observation point, wherein the statistical result is analyzed in accordance with a third set of configuration parameters; and
wherein the first, second, and third sets of configuration parameters can be modified at any time, after abnormal activity is detected by the analysis module, to alter a magnification level by which a subset of the network activity is subsequently monitored. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17)
-
-
18. A computer-executable method for isolating a source of abnormal network activity, the method comprising:
-
collecting a stream of flow records associated with a plurality of observation points within a network during a first time interval;
generating a plurality of statistical results by grouping the flow records, as each flow record is collected, by observation point and in accordance with a set of configuration parameters;
analyzing the plurality of statistical results upon completion of the first time interval to monitor network activity associated with each of the plurality of observation points;
modifying the set of configuration parameters, if abnormal network activity is detected during the step of analyzing, to alter a magnification level by which a subset of the network activity is subsequently monitored; and
repeating the steps of collecting, generating, analyzing, and modifying over one or more consecutive time intervals until the source of the abnormal network activity is isolated to one or more of the plurality of observation points. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25, 26)
-
-
27. A computer-usable medium, comprising:
-
a first set of program instructions executable on a computer system for collecting a stream of flow records from a plurality of observation points within a network;
a second set of program instructions executable on a computer system for generating a plurality of statistical results by grouping the flow records, as each flow record is collected, by observation point and in accordance with a set of configuration parameters;
a third set of program instructions executable on a computer system for analyzing the plurality of statistical results to monitor network activity associated with each of the plurality of observation points; and
wherein any of the first, second and third program instructions can be programmably reconfigured at any time, after abnormal activity is detected by the third set of program instructions, to alter a magnification level by which a subset of the network activity is subsequently monitored. - View Dependent Claims (28)
-
Specification