NETWORK ANALYSIS SYSTEM AND METHOD UTILIZING COLLECTED METADATA

• US 20110258315A1
• Filed: 06/27/2011
• Published: 10/20/2011
• Est. Priority Date: 11/13/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Whitmore, Brent S., Lawler, Geoff, La Cholter, William J.
• Granted Patent: US 8,631,124 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0273 using web services for network management, e.g. simple object access protocol [SOAP]
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99934 Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/9994 Distributed or remote access

Abstract

A system, method and computer program product are provided for analyzing network traffic associated with network services. Initially, network traffic and metadata are collected from a network. Thereafter, the network traffic is analyzed utilizing the metadata.

Claims

1-25. -25. (canceled)

26. A method, comprising:

collecting metadata;

correlating the metadata with network traffic through a command that invokes a web service associated with an application service provider identified from the network traffic; and

identifying a message in the network traffic to be authenticated based on the metadata.

27. The method as recited in claim 26, further comprising:

generating a parser, which is based on collected metadata, to analyze the network traffic.

28. The method as recited in claim 27, wherein the parser checks the network traffic for syntax errors.

29. The method as recited in claim 27, wherein the parser receives input in a form of at least one of:

source program instructions, interactive online commands, markup tags, and a defined interface.

30. The method as recited in claim 27, wherein the parser is provided as part of a compiler configured to receive input, which is broken into objects or attributes.

31. The method as recited in claim 26, wherein the metadata includes a Web Service Definition Language (WSDL) document.

32. The method as recited in claim 26, wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.

33. The method as recited in claim 26, wherein the metadata indicates scanning particular payloads, which are associated with web services, for malware.

34. The method as recited in claim 26, wherein the metadata includes a database schema.

35. The method as recited in claim 26, further comprising:

detecting at least one security issue associated with the network traffic based on the metadata.

36. Logic encoded in one or more non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

collecting metadata; and

correlating the metadata with network traffic through a command that invokes a web service associated with an application service provider identified from the network traffic, wherein the metadata indicates scanning particular payloads, which are associated with web services, for malware.

37. The logic as recited in claim 36, further comprising:

generating a parser, which is based on collected metadata, to analyze the network traffic.

38. The logic as recited in claim 37, wherein the parser checks the network traffic for syntax errors, and wherein the parser is provided as part of a compiler configured to receive input, which is broken into objects or attributes.

39. The logic as recited in claim 37, wherein the parser receives input in a form of at least one of:

source program instructions, interactive online commands, markup tags, and a defined interface.

40. The logic as recited in claim 36, wherein the metadata includes a Web Service Definition Language (WSDL) document.

41. The logic as recited in claim 36, wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.

42. An apparatus, comprising:

a network traffic collector;

a metadata aggregator;

a network analyzer coupled to the network traffic collector and the metadata aggregator; and

one or more processors operable to execute instructions associated with the network traffic collector, the metadata aggregator, and the network analyzer such that the apparatus is configured for;

collecting metadata; and

correlating the metadata with network traffic through a command that invokes a web service associated with an application service provider identified from the network traffic, wherein the metadata indicates scanning particular payloads, which are associated with web services, for malware.

43. The apparatus of claim 42, wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.

44. The apparatus of claim 42, wherein the apparatus is further configured for:

identifying a message in the network traffic to be authenticated based on the metadata; and

generating a parser, which is based on collected metadata, for analyzing the network traffic, wherein the parser checks the network traffic for syntax errors.