Systems and Methods For Wireless Network Forensics

• US 20070218874A1
• Filed: 03/17/2006
• Published: 09/20/2007
• Est. Priority Date: 03/17/2006
• Status: Abandoned Application

• Current Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Kailash, Kailash, Sinha, Amit, Regoti, Lakshmaiah
• Application Number:
  US11/276,930
• Publication Number:
  US 20070218874A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports

Abstract

Systems and methods for wireless forensics. Systems and methods can store data received from a wireless network. The data is stored utilizing differential records, thereby enabling query and expression processing.

Claims

1. A method for storing data associated with monitoring a wireless network, the method comprising the steps of:

a) receiving data from distributed monitoring devices;

b) classifying the data by type;

c) determining if a new absolute record is to be created based upon the type and upon a period since a previous absolute record was created;

d) based upon step c), storing the data in an absolute record indexed to the type and time;

e) storing the data in a differential record indexed to the type and time, wherein the differential record is derived from previous differential and absolute records of the same type and

f) repeating steps a) through e)

2. The method of claim 1, further comprising the steps of:

a) submitting a query based on a plurality of types of data and a time interval;

b) retrieving a set of absolute and differential records responsive to the query;

c) calculating the absolute value of the set of differential records, wherein the absolute value comprises the difference between the differential record and the previous absolute record.

3. The method of claim 1, wherein a new absolute record is created by step d) when either no absolute record exists for the type or a predetermined number of differential records exists associated with a previous absolute record for the type.

4. The method of claim 3, wherein the predetermined number of differential records is determined responsive to the efficiency of storage and retrieval of the differential records.

5. The method of claim 2, further comprising the step of displaying the query results, wherein the query results comprise the set of absolute records and the absolute values of the set of differential records.

6. The method of claim 5, wherein the query results are provided as graphs, trends, reports, alarms, and combinations thereof.

7. The method of claim 6, wherein the displaying step is performed on a user interface, wherein the user interface is accessed through one of a local server and a web browser.

8. The method of claim 1, wherein the distributed monitoring devices comprise any of sensors, access points, clients equipped with monitoring agents, and combinations thereof

9. The method of claim 5, wherein policy violations are identified by running a query, wherein the query identifies the desired policy.

10. The method of claim 5, wherein attack updates are performed by running a query, wherein the query is responsive to the desired attack.

11. The method of claim 5, wherein the wireless network radio frequency (RF) environment is recreated over a predetermined time interval by running a plurality of queries.

12. The method of claim 11, wherein the RF environment is displayed on a user interface.

13. The method of claim 1, wherein the data is stored in a data store coupled to one or more servers.

14. A method for storing data associated with monitoring a wireless network in association with performing wireless network forensics, the method comprising the steps of:

a) receiving a type of data wherein the data comprises forensic information relating to the wireless network;

b) storing an absolute record of a type of data at a set time; and

c) storing subsequent data of the same type in a differential record, wherein the differential record is based on the previous absolute record.

15. The method of claim 14, further comprising the step of retrieving a plurality of absolute and differential records responsive to a query and parsing the plurality of differential records to obtain absolute values.

16. A method of performing wireless network forensics, the method comprising the steps of:

a) submitting a query of wireless network forensic data based on a plurality of data types and a time interval;

b) parsing a set of differential and absolute records responsive to a query; and

c) displaying the plurality of records that satisfy the submitted query.

17. The method of claim 16, wherein the plurality of records comprise a plurality of absolute and differential records and wherein the differential records are stored as the difference from an absolute record.

18. A wireless network forensics system, the system comprising:

a) a data store operable to store records; and

b) a network interface coupled to a network;

c) a system processor comprising one or more processing elements, wherein the system processor is in communication with the data store and the network interface and wherein the system processor is programmed or adapted to;

i. store data received from the network, wherein the data comprises forensic information relating to a wireless network;

ii. accept queries and expressions;

iii. retrieve and parse data from the data store; and

iv. display data responsive to queries and expressions.

19. The wireless network forensics system of claim 18, the system further comprising a plurality of distributed monitoring devices in communication with the network interface.

20. The wireless network forensics system of claim 19, wherein the plurality of distributed monitoring devices comprises one or more sensors, access points, clients equipped with monitoring agents, or combinations thereof.

21. The wireless network forensics system of claim 18, the system further comprising a user interface and a remote browser interface.

22. The wireless network forensics system of claim 19, wherein the data comprises events, statistics, data, alarms, or combinations thereof received from the plurality of distributed monitoring devices.

23. The wireless network forensics system of claim 22, wherein the data is stored in a plurality of absolute and differential records indexed to data type and time.

24. The wireless network forensics system of claim 23, wherein the differential records comprise a value calculated based on a previous absolute record.

25. The wireless network forensics system of claim 24, wherein a new absolute record for a data type is stored when there is one of no absolute record of the data type, there is a page break in the data store, or a predetermined number of differential records of the data type have been stored.