Analyzing network traffic

• US 20080162135A1
• Filed: 12/30/2006
• Published: 07/03/2008
• Est. Priority Date: 12/30/2006
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Claudatos, Christopher Hercules, Andruss, William Dale, Bevan, Scott R.
• Granted Patent: US 8,577,680 B2
• Time in Patent Office: Days
• US Class Current: 704/243
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

A method, article of manufacture, and apparatus for monitoring data traffic on a network is disclosed. In an embodiment, this includes obtaining intrinsic data from at least a portion of the traffic, obtaining extrinsic data from at least a portion of the traffic, associating the intrinsic data with the extrinsic data, and logging the intrinsic data and extrinsic data. The portion of the traffic from which the intrinsic data and extrinsic data are derived may not be stored, or may be stored in encrypted form.

Claims

1. A method for monitoring voice traffic on a network, comprising:

identifying a voice portion of the traffic;

submitting the voice portion of the traffic to a speaker recognition engine;

receiving a speaker template from the speaker recognition engine;

obtaining data from the voice portion of the traffic;

associating the speaker template with the data; and

logging the speaker template and data in a log.

2. The method as recited in claim 1, wherein obtaining the data includes obtaining intrinsic data by examining headers of packets in a portion of the traffic.

3. The method as recited in claim 2, wherein obtaining the data includes obtaining extrinsic data by deriving data based on content within a portion of the traffic.

4. The method as recited in claim 3, wherein the intrinsic data includes at least one of the group comprising source address, destination address, source media access control (MAC) address, destination MAC address, protocol, route taken, time, date, package size, bandwidth, physical port number, and logical port number.

5. The method as recited in claim 4, wherein the extrinsic data includes information about at least one of the group comprising application, file or object type, event data, hash signature, location, encryption, identity, and locale depicted.

6. The method as recited in claim 1, wherein the method is performed without retaining the portion of the traffic from which the speaker template was obtained.

7. The method as recited in claim 1, further comprising comparing the speaker template to at least one existing speaker template.

8. The method as recited in claim 7, wherein comparing the speaker template to at least one existing speaker template includes retrieving the at least one existing speaker template from the log.

9. The method as recited in claim 7, further comprising indicating a match between the speaker template and the at least one existing speaker template if there is a match.

10. The method as recited in claim 9, further comprising logging the indication of the match.

11. The method as recited in claim 1, further comprising receiving a provided speaker template and comparing the provided speaker template to a speaker template in the log to determine if there is a match.

12. The method as recited in claim 11, further comprising retrieving the data associated with the speaker template if there is a match.

13. A method for monitoring voice traffic on a network, comprising:

identifying a voice portion of the traffic;

comparing the voice portion of the traffic to a lexicon to determine if there is a match;

obtaining data from the voice portion of the traffic; and

logging the data with an identification of the lexicon if there is a match between the voice portion of the traffic and the lexicon.

14. The method as recited in claim 13, wherein obtaining the data includes obtaining intrinsic data by examining headers of packets in a portion of the traffic.

15. The method as recited in claim 14, wherein obtaining the data includes obtaining extrinsic data by deriving data based on content within a portion of the traffic.

16. The method as recited in claim 15, wherein the intrinsic data includes at least one of the group comprising source address, destination address, source media access control (MAC) address, destination MAC address, protocol, route taken, time, date, package size, bandwidth, physical port number, and logical port number.

17. The method as recited in claim 16, wherein the extrinsic data includes information about at least one of the group comprising application, file or object type, event data, hash signature, location, encryption, identity, and locale depicted.

18. The method as recited in claim 13, wherein the method is performed without retaining the voice portion of the traffic.

19. The method as recited in claim 13, further comprising:

submitting the voice portion of the traffic to a speaker recognition engine;

receiving a speaker template from the speaker recognition engine;

associating the speaker template with the data; and

logging the speaker template.

20. A computer program product for monitoring voice traffic in a network, comprising a computer usable medium having machine readable code embodied therein for:

identifying a voice portion of the traffic;

submitting the voice portion of the traffic to a speaker recognition engine;

receiving a speaker template from the speaker recognition engine;

obtaining data from the voice portion of the traffic;

associating the speaker template with the data; and

logging the speaker template and data in a log.