Methods and systems for network traffic security

• US 20060092841A1
• Filed: 09/09/2005
• Published: 05/04/2006
• Est. Priority Date: 09/09/2004
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Baldonado, Omar C., Karam, Mansour J., Finn, Sean P., Lloyd, Michael A., Fraval, Pierre, McGuire, James G.
• Granted Patent: US 7,596,811 B2
• Time in Patent Office: Days
• US Class Current: 370/231
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5019 Ensuring fulfilment of SLA
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/121 by minimising delays
• CPC Class Codes: H04L 45/124 using a combination of metrics
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/15 in relation to multipoint traffic arrangements for broadcast or multicast in data networks H04L12/18
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/283 in response to processing delays, e.g. caused by jitter or round trip time [RTT]
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 47/822 : Collecting or measuring resource availability data
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 63/0263 : Rule management
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection

Abstract

The present invention is directed to methods of and systems for adaptive networking that monitors a network resource of a network. The method monitors an application performance. The method categorizes a first subset of traffic of the network. The categories for the first subset include trusted, known to be bad, and suspect. The method determines an action for a second subset of traffic based on the category for the first subset of traffic. Some embodiments provide a system for adaptive networking that includes a first device and traffic that has a first subset and a second subset. The system also includes a first resource and a second resource for the transmission of the traffic. The first device receives the traffic and categorizes the traffic into the first and second subsets. The first device assigns the first subset to the first resource. Some embodiments provide a network device that includes an input for receiving incoming traffic, an output for sending outgoing traffic, a categorization module that categorizes incoming traffic, and a resource assignment module that assigns the categorized traffic for a particular resource. A traffic category for the device includes suspect traffic.

Claims

1. A method comprising:

a. monitoring at least one of a network resource for a network and a performance of an application in a network;

b. categorizing network traffic into at least good, bad and suspect categories of traffic based upon the monitoring; and

c. treating at least two of the categories of traffic different from a third one of the categories of traffic.

2. The method of claim 1, further comprising:

a. determining an action for a first subset of traffic; and

b. categorizing a second subset of traffic.

3. The method of claim 1, wherein the first subset of traffic is categorized based on the step of monitoring the network resource.

4. The method of claim 1, wherein the first subset of traffic is categorized based on the step of monitoring the performance of the application.

5. The method of claim 2, further comprising the step of determining an action for the second subset of traffic based on the categorizing.

6. The method of claim 5, wherein the action for the second subset of traffic is based on the step of monitoring the network resource.

7. The method of claim 5, wherein the action for the second subset of traffic is based on the step of monitoring the application performance.

8. The method of claim 5, wherein the first subset and the second subset of traffic do not overlap.

9. The method of claim 5, wherein the first subset and the second subset of traffic overlap.

10. The method of claim 5, wherein the first subset and the second subset of traffic are the same.

11. The method of claim 2, further comprising:

a. tracking a history of users and traffic patterns; and

b. using the history in categorizing the first subset of traffic.

12. The method of claim 5, further comprising:

a. tracking a history of users and traffic patterns; and

b. using the history in determining an action for the second subset of traffic.

13. The method of claim 2, wherein the category for the first subset of traffic is based on a set of application management tools.

14. The method of claim 5, wherein the action for the second subset of traffic is based on a set of application management tools.

15. The method of claim 1, further comprising using a suite of protocols for the step of categorizing.

16. The method of claim 2, wherein the category for the second subset of traffic is based on a suite of protocols.

17. The method of claim 5, wherein the action for the second subset of traffic is based on a suite of protocols.

18. The method of claim 1, further comprising providing an always on architecture.

19. The method of claim 18, wherein providing the always on architecture comprises:

assigning the at least two categories of traffic to a first resource;

based on the categorizing, reassigning one category of the at least two categories of traffic to a second resource.

20. The method of claim 19, wherein the at least two categories comprises good and suspect categories of traffic, wherein the second resource is allocated for good traffic.

21. The method of claim 18, wherein providing the always on architecture comprises:

assigning the at least two categories of traffic to a first resource;

based on the monitoring, reassigning one category of the at least two categories of traffic to a second resource.

22. The method of claim 21, wherein the monitoring further comprises detecting an unusual network activity.

23. The method of claim 1, further comprising determining that an endpoint is trusted, wherein an endpoint is a source or a destination in the network for a transaction.

24. The method of claim 1, further comprising assigning an endpoint a frequent flyer status.

25. The method of claim 1, further comprising providing an optimization selected from the set comprising outbound performance optimization, outbound application performance optimization, outbound load optimization, inbound performance optimization, inbound application performance optimization, and inbound load optimization.

26. The method of claim 1, further comprising steering traffic away from an attack related performance problem.

27. The method of claim 26, wherein the performance problem includes one of application performance degradation, a brownout, and a blackout.

28. The method of claim 1, further comprising steering traffic away from an attack related load problem.

29. The method of claim 28, wherein the load problem includes one of congestion, application performance degradation, a brownout, and a blackout.

30. A method comprising:

a. discovering automatically a user by using traffic in a network;

b. monitoring a performance of an application relevant to the user;

c. assessing performance of the application; and

d. controlling the traffic.

31. The method of claim 30, wherein the step of controlling the traffic comprises enforcing a proper balance between load, cost, and application performance constraints.

32. The method of claim 30, wherein the step of controlling the traffic comprises a plurality of optionally selectable resources.

33. The method of claim 32, wherein the resources include one of a link, a path, an MPLS tag, a type of service (ToS) marking, and a virtual local access network (VLAN).

34. A method of routing data comprising:

a. receiving a data stream from a node, the data stream comprising a plurality of data packets;

b. classifying the plurality of data packets, wherein the classifications include;

i. trusted traffic, wherein trusted traffic includes data from a trusted source;

ii. bad traffic, wherein bad traffic includes data that is known to contain undesirable data; and

iii. suspect traffic, wherein suspect traffic includes data that is unknown or that is not from a trusted source.

35. The method of claim 34, further comprising:

a. routing the trusted traffic by using a first resource;

b. routing the bad traffic by using a second resource; and

c. routing the suspect traffic by using a third resource.

36. The method of claim 34, wherein a plurality of the first, second, and third resources are the same logical resource.

37. The method of claim 34, wherein a plurality of the first, second, and third resources are the same physical resource.

38. A network device comprising:

a. an input for receiving incoming traffic;

b. an output for sending outgoing traffic;

c. a categorization module that categorizes incoming traffic, wherein a category for the incoming traffic comprises suspect; and

d. a resource assignment module that assigns the categorized traffic for a particular resource.

39. The network device of claim 38, wherein the resource assignment comprises one or more resources selected from a set comprising a ToS tag, an MPLS tag, and a physical path.

40. The network device of claim 38, wherein the network device is a router.

41. A system for adaptive networking comprising:

traffic comprising a plurality of subsets, wherein a first subset includes suspect traffic;

a resource for the traffic, wherein the resource is allocated for suspect traffic; and

a first device for receiving the traffic, wherein the first device is configured to categorize the received traffic into the first subset.

42. The system of claim 41, wherein the first device is configured to assign the first subset to the resource.

43. The system of claim 41, further comprising an Internet service provider, wherein the first device is configured to receive the traffic flowing to and from the Internet service provider.

44. The system of claim 41, further comprising an enterprise network.

45. The system of claim 41, wherein the first device is further configured to send and receive a notification message, wherein a notification message comprises network control data that is separate from the traffic.