Systems, methods, and computer program products for passively transforming internet protocol (IP) network traffic

• US 20080144655A1
• Filed: 01/19/2007
• Published: 06/19/2008
• Est. Priority Date: 12/14/2006
• Status: Abandoned Application

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: Hargett, Byron Lee, Wall, Virgil Montgomery, Somerville, Garth Douglas, Walker, Jason Moore, Beam, James Frederick, Short, Jennifer Justina, Hester, Douglas Wayne, Ward, Robert Edward, Millham, Ricky G.
• Application Number:
  US11/655,726
• Publication Number:
  US 20080144655A1
• Time in Patent Office: Days
• US Class Current: 370/466
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Methods, systems, and computer program products for passively transforming IP network traffic are disclosed. According to one aspect, a method includes identifying one of an application protocol event and a business-level event in IP network traffic. Data associated with the identified event can be transformed into a usable format. Further, the transformed data can be fed in real-time to a backend system.

Claims

1. A method for passively transforming Internet protocol (IP) network traffic, the method comprising:

(a) identifying one of an application protocol event and a business-level event in IP network traffic;

(b) transforming data associated with the identified event into a usable format; and

(c) feeding the transformed data in real-time to a backend system.

2. The method of claim 1 wherein identifying one of an application protocol event and a business-level event includes identifying one of a hypertext transfer protocol (HTTP) event and a hypertext transfer protocol over secure socket layer (HTTPS) event.

3. The method of claim 1 wherein identifying one of an application protocol event and a business-level event includes identifying a sequence of client-server exchanges that collectively represent a business-level transaction.

4. The method of claim 3 comprising correlating the sequence of client-server exchanges to an application session of a user.

5. The method of claim 1 wherein identifying one of an application protocol event and a business-level event includes filtering the IP network traffic based on protocol characteristics.

6. The method of claim 1 wherein identifying one of an application protocol event and a business-level event includes identifying one of an application protocol event and a business-level event based on application client-server exchanges from a plurality of clients to and from a plurality of application servers.

7. The method of claim 1 comprising delivering the identified event onto an enterprise message bus using Java messaging service (JMS) interfaces.

8. The method of claim 1 comprising delivering the identified event to a backend system using transmission control protocol (TCP) connections.

9. The method of claim 1 comprising delivering the identified event as rows in a database using Java database connectivity (JDBC) interfaces.

10. The method of claim 1 comprising recording the identified event as a log file on a file system.

11. The method of claim 10 comprising recording the log file on a local file system.

12. The method of claim 10 comprising recording the log file on a remote file system.

13. The method of claim 12 comprising accessing the remote file system as a file share using server message block (SMB)/common Internet file system (CIFS) protocol.

14. The method of claim 12 comprising accessing the remote file system using network file system (NFS) protocol.

15. The method of claim 1 wherein the identified event includes application client-server exchanges.

16. The method of claim 15 comprising:

(a) determining that the identified event only includes client request data; and

(b) in response to determining that the identified event only includes client request data, delivering information associated with the identified event to the backend system before receiving a server response to the client request.

17. The method of claim 1 wherein feeding the transformed data includes feeding transformed data including a selected and interpreted subset of data present in the network traffic and information derived from the data in the network traffic.

18. The method of claim 1 wherein feeding the transformed data includes feeding the transformed data to the backend system using user datagram protocol (UDP) connections.

19. The method of claim 1 wherein feeding the transformed data includes feeding the transformed data to the backend system using system log (SYSLOG) protocol.

20. The method of claim 1 comprising simultaneously feeding the transformed data to multiple and different backend systems.

21. A system for passively transforming Internet protocol (IP) network traffic, the system comprising:

(a) a capture engine configured to identify one of an application protocol event and a business-level event in IP network traffic;

(b) a transformation engine configured to transform data associated with the identified event into a usable format; and

(c) a feed engine configured to feed the transformed data in real-time to a backend system.

22. The system of claim 21 wherein the capture engine is configured to identify one of a hypertext transfer protocol (HTTP) event and a hypertext transfer protocol over secure socket layer (HTTPS) event.

23. The system of claim 21 wherein the capture engine is configured to identify a sequence of client-server exchanges that collectively represent a business-level transaction.

24. The system of claim 23 wherein the capture engine is configured to correlate the sequence of client-server exchanges to an application session of a user.

25. The system of claim 21 wherein the capture engine is configured to filter the IP network traffic based on protocol characteristics.

26. The system of claim 21 wherein the capture engine is configured to identify one of an application protocol event and a business-level event based on application client-server exchanges from a plurality of clients to and from a plurality of application servers.

27. The system of claim 21 wherein the feed engine is configured to deliver the identified event onto an enterprise message bus using Java messaging service (JMS) interfaces.

28. The system of claim 21 wherein the feed engine is configured to deliver the identified event to a backend system using transmission control protocol (TCP) connections.

29. The system of claim 21 wherein the feed engine is configured to deliver the identified event as rows in a database using Java database connectivity (JDBC) interfaces.

30. The system of claim 21 wherein the capture engine is configured to record the identified event as a log file on a file system.

31. The system of claim 30 wherein the capture engine is configured to record the log file on a local file system.

32. The system of claim 30 wherein the capture engine is configured to record the log file on a remote file system.

33. The system of claim 32 wherein the capture engine is configured to access the remote file system as a file share using server message block (SMB)/common Internet file system (CIFS) protocol.

34. The system of claim 32 wherein the capture engine is configured to access the remote file system using network file system (NFS) protocol.

35. The system of claim 21 wherein the identified event includes application client-server exchanges.

36. The system of claim 35 wherein the capture engine is configured to:

(a) determine that the identified event only includes client request data; and

(b) deliver information associated with the identified event to the backend system before receiving a server response to the client request in response to determining that the identified event only includes client request data.

37. The system of claim 21 wherein the feed engine is configured to feed transformed data including a selected and interpreted subset of data present in the network traffic and information derived from the data in the network traffic.

38. The system of claim 21 wherein the feed engine is configured to feed the transformed data to the backend system using user datagram protocol (UDP) connections.

39. The system of claim 21 wherein the feed engine is configured to feed the transformed data to the backend system using system log (SYSLOG) protocol.

40. The system of claim 21 wherein the feed engine is configured to simultaneously feed the transformed data to multiple and different backend systems.

41. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) identifying one of an application protocol event and a business-level event in IP network traffic;

(b) transforming data associated with the identified event into a usable format; and

(c) feeding the transformed data in real-time to a backend system.

42. The computer program product of claim 41 wherein identifying one of an application protocol event and a business-level event includes identifying one of a hypertext transfer protocol (HTTP) event and a hypertext transfer protocol over secure socket layer (HTTPS) event.

43. The computer program product of claim 41 wherein identifying one of an application protocol event and a business-level event includes identifying a sequence of client-server exchanges that collectively represent a business-level transaction.

44. The computer program product of claim 43 comprising correlating the sequence of client-server exchanges to an application session of a user.

45. The computer program product of claim 41 wherein identifying one of an application protocol event and a business-level event includes filtering the IP network traffic based on protocol characteristics.

46. The computer program product of claim 41 wherein identifying one of an application protocol event and a business-level event includes identifying one of an application protocol event and a business-level event based on application client-server exchanges from a plurality of clients to and from a plurality of application servers.

47. The computer program product of claim 41 comprising delivering the identified event onto an enterprise message bus using Java messaging service (JMS) interfaces.

48. The computer program product of claim 41 comprising delivering the identified event to a backend system using transmission control protocol (TCP) connections.

49. The computer program product of claim 41 comprising delivering the identified event as rows in a database using Java database connectivity (JDBC) interfaces.

50. The computer program product of claim 41 comprising recording the identified event as a log file on a file system.

51. The computer program product of claim 50 comprising recording the log file on a local file system.

52. The computer program product of claim 50 comprising recording the log file on a remote file system.

53. The computer program product of claim 52 comprising accessing the remote file system as a file share using server message block (SMB)/common Internet file system (CIFS) protocol.

54. The computer program product of claim 52 comprising accessing the remote file system using network file system (NFS) protocol.

55. The computer program product of claim 41 wherein the identified event includes application client-server exchanges.

56. The computer program product of claim 55 comprising:

(a) determining that the identified event only includes client request data; and

(b) in response to determining that the identified event only includes client request data, delivering information associated with the identified event to the backend system before receiving a server response to the client request.

57. The computer program product of claim 41 wherein feeding the transformed data includes feeding transformed data including a selected and interpreted subset of data present in the network traffic and information derived from the data in the network traffic.

58. The computer program product of claim 41 wherein feeding the transformed data includes feeding the transformed data to the backend system using user datagram protocol (UDP) connections.

59. The computer program product of claim 41 wherein feeding the transformed data includes feeding the transformed data to the backend system using system log (SYSLOG) protocol.

60. The computer program product of claim 41 comprising simultaneously feeding the transformed data to multiple and different backend systems.