METHODS AND APPARATUS FOR TRACKING DATA FLOW BASED ON FLOW STATE VALUES

• US 20110154132A1
• Filed: 12/23/2009
• Published: 06/23/2011
• Est. Priority Date: 12/23/2009
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: AYBAY, Gunes
• Granted Patent: US 9,264,321 B2
• Time in Patent Office: Days
• US Class Current: 714/49
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

In one embodiment, a processor-readable medium storing code representing instructions that when executed by a processor cause the processor to update, at a memory location, a first flow state value associated with a data flow to a second flow state value when at least one of a packet from the data flow is received or the memory location is selected after a time period has expired. At least a portion of the packet is analyzed when the second flow state value represents a flow rate of a network data flow anomaly.

Claims

1. A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to:

update, at a memory location, a first flow state value associated with a data flow to a second flow state value when at least one of a packet from the data flow is received or the memory location is selected after a time period has expired; and

analyze at least a portion of the packet when the second flow state value represents a flow rate of a network data flow anomaly.

2. The processor-readable medium of claim 1, wherein the update of the flow state value is based a progression through a series of flow state values including the first flow state value and the second flow state value.

3. The processor-readable medium of claim 1, wherein the first flow state value is updated in a first direction within a series of flow state values when the packet is received, the first flow state value is updated in a second direction within the series of flow state values after the time period has expired.

4. The processor-readable medium of claim 1, wherein the memory location is within a memory, the time period corresponds with a processing cycle time period associated with a plurality of flow state values stored in the memory and including the first flow state value and the second flow state value.

5. The processor-readable medium of claim 4, wherein the processing cycle time period is defined, at least in part, by a number of the plurality of flow state values stored in the memory and including the first flow state value and the second flow state value.

6. The processor-readable medium of claim 1, wherein the time period has a duration defined such that the second flow state value represents the flow rate of the network data flow anomaly when a specified number of packets from the data flow are received during the time period.

7. The processor-readable medium of claim 1, wherein the packet is received at a flow module, and the memory location is selected at the flow module, the update of the first flow state value is performed at the flow module.

8. An apparatus, comprising:

a memory configured to store a flow state value at a memory location;

a flow state advancement module configured to change the flow state value in response to an index value representing the memory location being defined at the flow state advancement module based on at least a portion of a packet; and

a flow state timing module configured to change the flow state value in response to a time period expiring.

9. The apparatus of claim 8, wherein the change of the flow state value associated with the flow state advancement module includes incrementing the flow state value, the change of the flow state value associated with the flow state timing module includes decrementing the flow state value.

10. The apparatus of claim 8, wherein the flow state value is from a series of flow state values, the time period has a duration based on an order of the flow state value within the series of flow states value.

11. The apparatus of claim 8, further comprising:

a flow analysis module configured to analyze the packet in response to the flow state value matching a threshold flow state value when the flow state value is changed by the flow state advancement module.

12. A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to:

receive a packet included in a data flow;

associate a memory location with the data flow based on at least a portion of the packet;

change, at a first time, a first flow state value at the memory location from the first flow state value to a second flow state value in response to the memory location being associated with the data flow; and

change, at a second time after the first time, the second flow state value to the first flow state value when the memory location is selected based on a counter value.

13. The processor-readable medium of claim 12, further storing code representing instructions that when executed by the processor cause the processor to:

define a hash value based on the portion of the packet, the memory location is associated with the data flow based on the hash value.

14. The processor-readable medium of claim 12, wherein at least one of the first flow state value or the second flow state value is defined by at least two binary bit values.

15. The processor-readable medium of claim 12, wherein the first flow state value and the second flow state are included in a series of flow state values.

16. The processor-readable medium of claim 12, wherein the portion of the packet is a first portion of the packet,

the processor-readable medium further storing code representing instructions that when executed by the processor cause the processor to:

send a second portion of the packet to a flow analysis module when the second flow state value matches a threshold flow state value.

17. The processor-readable medium of claim 12, wherein the data flow is transmitted within a data center.

18. A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to:

associate a packet with a flow state value;

change the flow state value based on an order of a series of flow state values in response to the packet being associated with the flow state value; and

analyze a portion of the packet when the flow state value matches a threshold flow state value after the change.

19. The processor-readable medium of claim 18, wherein the packet is a first packet, the flow state value is changed at a first time,

the processor-readable medium further storing code representing instructions that when executed by the processor cause the processor to:

receive an indicator that a time period has expired; and

change the flow state value at a second time after the first time in response to the indicator, the change at the second time being based on the order of the series of flow state values.

20. The processor-readable medium of claim 18, wherein the packet is a first packet, the flow state value is changed from a first flow state to a second flow state value,

the processor-readable medium further storing code representing instructions that when executed by the processor cause the processor to:

receive an indicator that a time period has expired; and

change the flow state value at a second time from the second flow state value to the first flow state value in response to the indicator, the second time being after the first time.

21. The processor-readable medium of claim 18, wherein the packet is a first packet, the flow state value is changed at a first time,

the processor-readable medium further storing code representing instructions that when executed by the processor cause the processor to:

associate a second packet with the flow state value; and

change the flow state value at a second time after the first time in response to the second packet being associated with the flow state value, the change at the second time being based on the order of the series of flow state values.

22. The processor-readable medium of claim 21, wherein the flow state value is changed at the first time from a first flow state value to a second flow state value, the flow state value is changed at the second time from the second flow state value to a third flow state value.

23. The processor-readable medium of claim 22, further storing code representing instructions that when executed by the processor cause the processor to:

receive an indicator that a time period has expired, the first time and the second time being within the time period; and

change the flow state value at a third time from the third flow state value to the second flow state value in response to the indicator, the third time being after the time period has expired.