Method of determining intra-session event correlation across network address translation devices

• US 20060095587A1
• Filed: 10/31/2005
• Published: 05/04/2006
• Est. Priority Date: 06/23/2003
• Status: Active Grant

• Current Assignee: Partha Bhattacharya, Yu Liao
• Original Assignee: Partha Bhattacharya, Yu Liao
• Inventors: Liao, Yu, Bhattacharya, Partha
• Granted Patent: US 7,797,419 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An intra-session network correlation system receives a stream of network events and groups the events into different network sessions according to event parameters and corresponding network address translation (NAT) information. An event in the stream is first matched against any existing session, and then categorized using the information about a NAT device that translates a message to which the event is related. Finally, at a predefined time, a categorized event is processed to identify other categorized events in accordance with a NAT message or an expiry timer associated with the categorized event; the categorized event and identified other categorized events are grouped into the same network session.

Claims

1. A method, comprising:

receiving a network event with a set of event parameters;

determining whether the network event belongs to a network session associated with one or more previously received network events;

categorizing the incoming event into the same network session as the one or more previously received events;

comparing the network event to information representing one or more NAT devices and one or more network address translation rules respectively associated with the NAT devices;

associating the network event with a particular NAT rule of one of the NAT devices;

estimating one or more other events that are associated with the network event, based on the particular NAT rule;

determining whether the one or more other events belong to the same network session.

2. The method of claim 1, further comprising performing, at a predefined time:

processing the one or more previously received network events using network session information associated with the one or more previously received network events to result in identifying one or more particular previously received network events belonging to the same network session;

grouping the particular previously received network events;

sending the grouped events to a network security monitoring device.

3. A method of grouping network events, comprising:

receiving a stream of network events, each network event including a set of event parameters in association with a network session that corresponds to a message being transmitted through a network;

making an initial session determination by determining whether a particular event belongs to a same network session as any previously received event;

identifying information of network address translations performed by one or more devices along a network transmission path associated with the particular network event;

categorizing the network event in accordance with at least one of the session determination and the network address translation information;

processing a categorized network event to identify another categorized network event, if any, belonging to a same network session as the categorized network event;

grouping the categorized network event and the identified other categorized network event, if any, into a set.

4. The method of claim 3, wherein the set of event parameters include source address, source port, destination address, destination, port, and network protocol.

5. The method of claim 3, wherein said network session is a communication channel established between a source host and a destination host over a network.

6. The method of claim 3, wherein the initial session determination includes comparing the event parameters of a newly received network event with the event parameters of any previously received network event, and if there is a match, determining that the newly received event belongs to a same network session as those previously received matching events.

7. The method of claim 3, wherein each of said one or more devices is associated with at least one network address translation rule, each rule comprising a pre-mapping parameter domain and a post-mapping parameter domain for one or more event parameters.

8. The method of claim 7, wherein the pre-mapping or post-mapping domains of two network address translation rules may overlap each other.

9. The method of claim 3, wherein said identifying includes identifying a first network address translation rule associated with a first device, if any, on a network transmission path whose pre-mapping parameter domain contains the parameters of the network event;

estimating a first set of event parameters contained in the post-mapping parameter domain of the first rule after applying the first rule to the network event;

identifying a second network address translation rule associated with a second device, if any, on a network transmission path whose post-mapping parameter domain contains the parameters of the network event; and

estimating a second set of event parameters contained in the pre-mapping parameter domain of the second rule after applying the second rule to the network event.

10. The method of claim 3, wherein said categorizing includes associating the network event with any previously received event in accordance with the initial session determination result;

and

associating the network event with any previously received event in accordance with the network address translation information obtained in said identifying

11. The method of claim 3, wherein the categorized network event and the identified other categorized network event belong to different categories during said categorizing.

12. The method of claim 3, wherein said processing is performed in accordance with the identified network address translation information for the network transmission path associated with the network event.

13. The method of claim 3, wherein said processing is performed in accordance with network address translation information received after arrival of the categorized network event.

17. The method of claim 3, wherein the categorized network event and the identified other categorized network event belong to different categories during said categorizing.

18. The method of claim 3, wherein said processing is performed in accordance with the identified network address translation information for the network transmission path associated with the network event.

19. The method of claim 3, wherein said processing is performed in accordance with network address translation information received after arrival of the categorized network event.

14. A method, comprising the computer-implemented steps of:

receiving a stream of network events;

matching a particular network event in the stream against any existing session;

categorizing the event based on corresponding network address translation (NAT) information about a NAT device that translates a message to which the event is related;

processing the event to identify other previously categorized events in accordance with a NAT message that is associated with the categorized event;

grouping the categorized event and the identified other categorized events into the same network session.

15. The method of claim 14, wherein processing the event comprises identifying other previously categorized events in accordance with an expiry timer that is associated with the categorized event.

16. The method of claim 14, further comprising sending the grouped events for the same network session to a network security monitoring device.

20. A method of grouping network events that are emitted by one or more network routing or network switching devices in a packet-switched telecommunications network, the method comprising the computer-implemented steps of:

receiving a stream of network events, each network event including a set of event parameters in association with a network session that corresponds to a message being transmitted through a network, wherein the set of event parameters include source address, source port, destination address, destination, port, and network protocol;

making an initial session determination by determining whether a particular event belongs to a same network session as any previously received event;

wherein said network session is a communication channel established between a source host and a destination host over the network, wherein the initial session determination includes comparing the event parameters of a newly received network event with the event parameters of any previously received network event, and if there is a match, determining that the newly received event belongs to a same network session as those previously received matching events;

identifying information of network address translations performed by one or more of the devices that are logically located along a network transmission path associated with the particular network event, wherein each of said one or more devices is associated with at least one network address translation rule, each rule comprising a pre-mapping parameter domain and a post-mapping parameter domain for one or more event parameters, wherein the pre-mapping or post-mapping domains of two network address translation rules may overlap each other;

categorizing the network event in accordance with at least one of the session determination and the network address translation information;

processing a categorized network event to identify another categorized network event, if any, belonging to a same network session as the categorized network event;

grouping the categorized network event and the identified other categorized network event, if any, into a set;

wherein the categorized network event and the identified other categorized network event belong to different categories during said categorizing;

wherein said processing is performed in accordance with the identified network address translation information for the network transmission path associated with the network event;

wherein said processing is performed in accordance with network address translation information received after arrival of the categorized network event.