Dynamic network tuner for the automated correlation of networking device functionality and network-related performance

• US 20070192860A1
• Filed: 02/06/2006
• Published: 08/16/2007
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Hiscock, James
• Granted Patent: US 9,747,439 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A dynamic network tuner establishes fluid, continuous, and automatic correlation between the extent and/or degree of a networking device'"'"'s functionality, on the one hand, and the network-related performance (i.e., network data traffic and/or network application performance), on the other. The dynamic network tuner can be embodied as a discrete device ready for installation into a host network. Preferably, such (and like) tuner embodiments are integrated into a network to automatically correlate, according to user-predefined parameters, the network'"'"'s performance with the operation within the network of specifically-targeted, performance-altering networking devices, such as network security devices, or more preferably and particularly, intrusion prevention devices.

Claims

1. A network comprising two or more nodes communicably linked to enable transmission of data packets therebetween, the network further comprising:

(a) an intrusion prevention system capable of executing a filter protocol from a filter protocol set upon detection by the intrusion prevention system of a real or potential network threat, said execution of said filter protocol effecting substantially said transmission of data packets;

(b) a network-related performance monitor capable of monitoring at least one network-related performance parameter and thereby generating network-related performance information;

(c) a tuning agent capable of obtaining or receiving said network-related performance information from said network-related performance monitor and, in a substantially automatic predetermined response thereto, effecting said execution of said filter protocol or said detection by the intrusion prevention system, or effecting a modification of said filter protocol set.

2. The network of claim 1, wherein said intrusion prevention system is installed in-line with respect to said transmission of data packets to enable execution of said filter protocol on each said data packet passing therethrough.

3. The network of claim 2, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

4. The network of claim 2, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

5. The network of claim 3, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

6. The network of claim 1, wherein the tuning agent comprises, housed within a common enclosure:

(a) means for communicating with said network-related performance monitor;

(b) means for communicating with said intrusion prevention system; and

(c) means for accomplishing said substantially automatic predetermined response.

7. The network of claim 6, wherein said network-related performance monitor is also housed within said common enclosure.

8. The network of claim 6, wherein said intrusion prevention system is also housed within said common enclosure.

9. A network comprising:

(a) two or more nodes communicably linked to enable transmission of data packets therebetween;

(b) at least one networking device capable of executing a specified protocol or application effecting substantially said transmission of data packets;

(c) a network-related performance monitor capable of monitoring at least one network-related performance parameter and thereby generating network-related performance information; and

(d) a tuning agent capable of obtaining or receiving said network-related performance information from said network-related performance monitor and, in a substantially automatic predetermined response thereto, effecting a modification of said specified protocol or application.

10. The network of claim 9, wherein the tuning agent comprises, housed within a common enclosure:

(a) means for communicating with said network-related performance monitor;

(b) means for communicating with said networking device; and

(c) means for accomplishing said substantially automatic predetermined response.

11. The network of claim 9, wherein said network-related performance monitor in also housed within said common enclosure.

12. A dynamic network tuner configured for installation and use in a network, wherein said network comprises two or more nodes, a network-related performance monitor, and a networking device capable of executing a specified protocol or application that substantially effects data packet transmission within said network, and wherein the dynamic network tuner comprises, housed within a common enclosure:

(a) means for communicating with said network-related performance monitor;

(b) means for communicating with said networking device; and

(c) means for effecting a modification of said specified protocol or application.

13. The dynamic network tuner of claim 12, wherein

said networking device is an in-line intrusion prevention system capable of executing a filter protocol from a filter protocol set upon detection by the intrusion prevention system of a real or potential network threat, said filter protocol being said specified protocol or application.

14. The dynamic network tuner of claim 13, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

15. The dynamic network tuner of claim 13, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

16. A dynamic network tuner and monitor configured for installation and use in a network, said network comprising two or more nodes and at least one networking device capable of executing a specified protocol or application that substantially effects data packet transmission within said network, the dynamic network tuner and monitor comprising, housed within a common enclosure:

(a) a network-related performance monitor capable of monitoring at least one network-related performance parameter and thereby generating network-related performance information; and

(b) a tuning agent capable of effecting a modification of said specified protocol or application in a substantially predetermined response to said network-related performance information.

17. The dynamic network tuner and monitor of claim 16, wherein

said networking device is an in-line intrusion prevention system capable of executing a filter protocol from a filter protocol set upon detection by the intrusion prevention system of a real or potential network threat, said filter protocol being said specified protocol or application.

18. The dynamic network tuner and monitor of claim 17, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

19. The dynamic network tuner and monitor of claim 17, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.