META-INSTRUMENTATION FOR SECURITY ANALYSIS

• US 20100293415A1
• Filed: 07/27/2010
• Published: 11/18/2010
• Est. Priority Date: 09/05/2007
• Status: Active Grant

• Current Assignee: Spirent Communications Incorporated
• Original Assignee: Mu Security, Inc.
• Inventors: BEDDOE, Marshall A., Maufer, Thomas A.
• Granted Patent: US 8,074,097 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/30 Monitoring

Abstract

A system and method for analyzing and/or testing member devices in a multi-device system. The multi-device system includes a device-under-analysis (DUA) and a device-under-observation (DUO). An analyzer that is external to the multi-device system generates and sends test messages to the DUA. The analyzer monitors the health of the multi-device system through the DUO and detects a system-wide impact of the DUA caused by the test messages. The analyzer analyzes the DUA based on the test messages and the system-wide impact.

Claims

1. A method for testing and analyzing a device-under-analysis (DUA), comprising:

establishing a first communication link between the DUA and an analyzer, wherein the analyzer is external to the DUA;

establishing a second communication link between a device-under-observation (DUO) and the analyzer, the DUA and the DUO being distinct member devices of a multi-device system;

transmitting via the first communication link a test case to the DUA;

monitoring via the second communication link a system-wide impact of the DUA in the multi-device system caused by the test case; and

analyzing the DUA based on the test case and the system-wide impact.

2. The method of claim 1, wherein the analyzer is not a member device of the multi-device system.

3. The method of claim 1, wherein the system-wide impact of the DUA in the multi-device system comprises a change or an attempt to change a system-wide variable.

4. The method of claim 3, wherein the system-wide variable comprises at least one selected from a group consisting of a routing table and a shared database.

5. The method of claim 1, wherein the system-wide impact of the DUA in the multi-device system comprises a malfunction in a member device of the multi-device system.

6. The method of claim 1, wherein a communication protocol of the first communication link is different from a communication protocol of the second communication link.

7. The method of claim 1, further comprising:

monitoring a response of the DUA to the test case, wherein analyzing the DUA further comprises analyzing the DUA based on the response of the DUA to the test case.

8. The method of claim 1, wherein monitoring the system-wide impact of the DUA in the multi-device system further comprises:

establishing a first snapshot of a system-wide variable of the multi-device system or the DUO before transmitting the test case to the DUA;

establishing a second snapshot of the system-wide variable of the multi-device system or the DUO after transmitting the test case to the DUA; and

comparing the first and the second snapshots to identify a system-wide impact of the DUA in the multi-device system.

9. The method of claim 1, wherein analyzing the DUA further comprises:

determining that the test case is a cause of the system-wide impact.

10. The method of claim 1, further comprising:

generating the test case based on one of the following information;

a supported communication protocol of the DUA, a software configuration of the DUA, and a hardware configuration of the DUA.

11. The method of claim 1, wherein the second communication link does not pass through the DUA.

12. A computer program product for testing and analyzing a device-under-analysis (DUA), the computer program product comprising a computer-readable medium containing computer program code for performing a method comprising:

establishing a first communication link between the DUA and an analyzer, wherein the analyzer is external to the DUA;

establishing a second communication link between a device-under-observation (DUO) and the analyzer, the DUA and the DUO being distinct member devices of a multi-device system;

transmitting via the first communication link a test case to the DUA;

monitoring via the second communication link a system-wide impact of the DUA in the multi-device system caused by the test case; and

analyzing the DUA based on the test case and the system-wide impact.

13. The computer program product of claim 12, wherein the analyzer is not a member device of the multi-device system.

14. The computer program product of claim 12, wherein the system-wide impact of the DUA in the multi-device system comprises a change or an attempt to change a system-wide variable.

15. The computer program product of claim 12, wherein the system-wide variable comprises at least one selected from a group consisting of a routing table and a shared database.

16. The computer program product of claim 12, wherein the system-wide impact of the DUA in the multi-device system comprises a malfunction in a member device of the multi-device system.

17. The computer program product of claim 12, wherein a communication protocol of the first communication link is different from a communication protocol of the second communication link.

18. The computer program product of claim 12, wherein the method further comprises:

monitoring a response of the DUA to the test case, wherein analyzing the DUA further comprises analyzing the DUA based on the response of the DUA to the test case.

19. The computer program product of claim 12, wherein monitoring the system-wide impact of the DUA in the multi-device system further comprises:

establishing a first snapshot of a system-wide variable of the multi-device system or the DUO before transmitting the test case to the DUA;

establishing a second snapshot of the system-wide variable of the multi-device system or the DUO after transmitting the test case to the DUA; and

comparing the first and the second snapshots to identify a system-wide impact of the DUA in the multi-device system.

20. The computer program product of claim 12, wherein analyzing the DUA further comprises:

determining that the test case is a cause of the system-wide impact.

21. The computer program product of claim 12, wherein the method further comprises:

generating the test case based on one of the following information;

a supported communication protocol of the DUA, a software configuration of the DUA, and a hardware configuration of the DUA.

22. The computer program product of claim 12, wherein the second communication link does not pass through the DUA.