SERVER RESOURCE MANAGEMENT, ANALYSIS, AND INTRUSION NEGATION

• US 20080133749A1
• Filed: 02/06/2008
• Published: 06/05/2008
• Est. Priority Date: 11/08/2002
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Federal Network Systems LLC (Jacobs Solutions, Inc.)
• Inventors: Sample, Char
• Granted Patent: US 8,397,296 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A console host and intrusion negation system (CHAINS) includes a host component and a console component. The host component monitors resources at a server. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Claims

1. A method comprising:

monitoring at least one resource associated with a network server, the at least one resource including a communication interface of the network server;

comparing activity levels of the at least one resource to predetermined threshold activity levels; and

reducing usage of one of the at least one resource when the activity level associated with the one of the at least one resource increases above the predetermined threshold activity level associated therewith;

wherein monitoring the at least one resource includes determining a number of open network connections using the a communication interface of the network server, and wherein reducing usage of the one of the at least one resource includes reducing the number of open network connections by closing open network connections based on a priority of the open network connection.

2. The method of claim 1, wherein the at least one resource includes a random access memory associated with the network server, and wherein monitoring the at least one resource includes determining usage of the random access memory associated with the network server.

3. The method of claim 2, wherein reducing usage of the one of the at least one resource includes reducing the usage of the random access memory by shutting down inactive processes.

4. The method of claim 1, wherein the at least one resource includes a processor of the network server, and wherein monitoring the at least one resource includes determining usage of the processor of the network server.

5. The method of claim 4, wherein reducing usage of the one of the at least one resource includes reducing the usage of the processor by shutting down lower priority processes.

6. The method of claim 1, wherein the at least one resource includes a hard disk drive associated with the network server, and wherein monitoring the at least one resource includes determining usage of the hard disk drive associated with the network server.

7. The method of claim 6, wherein reducing usage of the one of the at least one resource includes reducing the usage of the hard disk drive by compressing files.

8. The method of claim 1, further comprising:

alerting a user when the activity level associated with the one of the at least one resource increases above the predetermined threshold activity level.

9. The method of claim 8, wherein alerting the user includes transmitting an alert to a remote computer.

10. The method of claim 1, wherein the predetermined threshold activity levels are received from a remote computer.

11. The method of claim 1, wherein reducing usage of the one of the at least one resource further includes refusing to open new network connections.

12. A computer readable medium storing instructions executable by a processor, the instructions configured to cause the processor to perform the method of claim 1.

13. A method comprising:

providing an interface having interactive elements, the interactive elements configured to allow indication of a threshold associated with an activity level of one of a number of resources associated with at least one of a plurality of network servers, the number of resources including at least one of a network connection, a processor, a random access memory, and a hard disk drive;

receiving an indication to set a first threshold associated with a first resource of the number of resources and a first network server of the plurality of network servers;

transmitting a message to the first network server, the message containing the first threshold;

receiving a first alert from a second network server of the plurality of network servers, the first alert indicating that the activity level of a second resource of the number of resources associated with the second network server has exceeded a second threshold;

providing the alert to a user;

providing instruction to the second network server to use the second resource associated with another of the plurality of network servers.

14. The method of claim 13, wherein providing the alert includes at least one of displaying the alert and sending a message containing the alert.

15. The method of claim 13, further comprising:

logging the alert.

16. The method of claim 13, wherein the first threshold and the second threshold are the same, the first resource and the second resource are the same, and the first network server and the second network server are the same.

17. The method of claim 13, further comprising:

receiving a second alert from a third network server of the plurality of network servers, the second alert indicating that the activity level of the second resource associated with the third network server has exceeded a third threshold;

correlating the first alert and the second alert based on similarity of resource and timing of the first alert and second alert;

providing an indication of a denial of service attack based on the correlation.

18. A computer readable medium storing instructions executable by a processor, the instructions configured to cause the processor to perform the method of claim 13.