Using a Content Delivery Network for Security Monitoring

• US 20110055371A1
• Filed: 08/26/2009
• Published: 03/03/2011
• Est. Priority Date: 08/26/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Serban, Cristina
• Granted Patent: US 8,874,724 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/885 Monitoring specific for caches
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A content delivery network includes a plurality of cache servers. Each cache server is configured to receive a request for content from a client system and receive content and security data from a content server. Each cache server is further configured to provide the content to the client system and provide the security data to a monitoring system.

Claims

1. A content delivery network comprising:

a plurality of cache servers, each cache server configured to;

receive a request for content from a client system;

receive content and security data from a content server;

provide the content to the client system; and

provide the security data to a monitoring system remote from the client system.

2. The content delivery network of claim 1, wherein the security data includes information from system logs, configuration information, system information, or any combination thereof.

3. The content delivery network of claim 2, wherein the configuration information includes the size of configuration files, last modification time of the configuration files, hashes of the configuration files, recent changes to the configuration files, or any combination thereof.

4. The content delivery network of claim 2, wherein the system information includes CPU utilization, bandwidth utilization, storage utilization, number of concurrent connections, processor temperature, fan speed, drive status, or any combination thereof.

5. A monitoring system comprising:

a processor configured to;

receive security data from a cache server, the security data corresponding to a content server;

analyze the security data to identify a performance anomaly; and

generate an alert in response to the performance anomaly.

6. The monitoring system of claim 5, wherein the security data includes information from system logs, configuration information, system information, or any combination thereof.

7. The monitoring system of claim 6, wherein the configuration information includes the size of configuration files, last modification time of the configuration files, hashes of the configuration files, recent changes to the configuration files, or any combination thereof.

8. The monitoring system of claim 6, wherein the system information includes CPU utilization, bandwidth utilization, storage utilization, number of concurrent connections, processor temperature, fan speed, drive status, or any combination thereof.

9. The monitoring system of claim 5, wherein the processor is further configured to send an instruction to disconnect the content server from the network in response to the performance anomaly.

10. The monitoring system of claim 5, wherein the processor is further configured to send an instruction to increase logging of network activity in response to the performance anomaly.

11. The monitoring system of claim 5, wherein the processor is further configured to receive additional security data corresponding to the content server from a second cache server.

12. The monitoring system of claim 11, wherein analyzing the security data to detect the performance anomaly includes comparing the security data with the additional security data to determine if the security data is altered.

13. A computer readable medium comprising a plurality of instructions to manipulate a processor, the plurality of instructions comprising:

instructions to collect security data;

instructions to receive a request for content from a cache server; and

instructions to provide the content and the security data to the cache server in response to the request for the content.

14. The computer readable medium of claim 13, wherein the security data includes information from system logs, configuration information, system information, or any combination thereof.

15. The computer readable medium of claim 14, wherein the configuration information includes the size of configuration files, last modification time of the configuration files, hashes of the configuration files, recent changes to the configuration files, or any combination thereof.

16. The computer readable medium of claim 14, wherein the system information includes CPU utilization, bandwidth utilization, storage utilization, number of concurrent connections, processor temperature, fan speed, drive status, or any combination thereof.