Method and System for Monitoring Flows in Network Traffic

• US 20120047248A1
• Filed: 08/20/2010
• Published: 02/23/2012
• Est. Priority Date: 08/20/2010
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Makhija, Dinesh
• Granted Patent: US 9,055,113 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method and system for correlating web content with content providers to determine the origin of the content such that it is not necessary to look inside the information exchange. The method and system maintains sequences of reference points, which are ordered lists of content providers accessed by subscribers over time, and correlates the internet content applications, such as video, found in network traffic to the sequence of reference points accessed by subscribers to determine the origins of the content even when the content being delivered by third-party content delivery networks.

Claims

1. A method for correlating network traffic, the method comprising:

maintaining a sequence of reference points for subscribers, the sequence of reference points being ordered lists of content providers accessed by the subscribers over time;

monitoring new network traffic for characteristics of internet content applications to be monitored; and

upon finding the characteristics of the internet content applications to be monitored in the network traffic, searching the sequence of reference points for the subscribers accessing the monitored internet content applications, and correlating the monitored internet content applications with the reference points for the subscribers to determine content providers for the internet content applications.

2. The method according to claim 1, further comprising storing to a database the monitored internet content applications used by the different subscribers and content providers originating the monitored internet content applications based on the reference points.

3. The method according to claim 1, further comprising deleting reference points for the subscribers after a predetermined amount of time has elapsed.

4. The method according to claim 1, wherein the step of monitoring the network traffic for monitored internet content applications comprises examining TCP/UDP ports of the network traffic.

5. The method according to claim 1, wherein the step of monitoring the network traffic for monitored internet content applications comprises examining patterns found in network traffic.

6. The method according to claim 1, wherein the step of monitoring the network traffic for monitored internet content applications comprises examining stateful messages in the network traffic.

7. The method according to claim 1, wherein the step of monitoring the network traffic for monitored internet content applications comprises examining the network traffic based on rate, payload lengths, and message sequences.

8. The method according to claim 1, wherein the step of maintaining a sequence of reference points for the subscribers comprises defining a list of subscribers to be monitored.

9. The method according to claim 1, wherein the step of maintaining a sequence of reference points for subscribers comprises learning a list of subscribers to be monitored by monitoring the network traffic.

10. A monitoring system for correlating network traffic, the system comprising:

a storage medium for maintaining a sequence of reference points for subscribers, the sequence of reference points being lists of content providers accessed by the subscribers over time;

a processor system that monitors new network traffic for characteristics of internet content applications, finds characteristics of the internet content applications to be monitored in the network traffic, searches the sequence of reference points for the subscribers accessing the monitored internet content applications, and correlates the monitored internet content applications with the reference points for the subscribers to determine the content provider for the internet content applications.

11. The system according to claim 10, further comprising storing to a database in the storage medium the monitored internet content applications used by the different subscribers and content providers originating the monitored internet content applications based on the reference points.

12. The system according to claim 10, wherein processor system deletes reference points for the subscribers after a predetermined amount of time has elapsed.

13. The system according to claim 10, wherein the processor system examines TCP/UDP ports of the network traffic.

14. The system according to claim 10, wherein the processor system examines patterns found in network traffic.

15. The system according to claim 10, wherein the processor system examines stateful messages in the network traffic.

16. The system according to claim 10, wherein the processor system examines the network traffic based on rate, payload lengths, and message sequences.

17. The system according to claim 10, wherein the processor system maintains a subscriber table which is a predefined list of subscribers to be monitored.

18. The system according to claim 10, wherein the processor system maintains a subscriber table which is a predefined list of subscribers to be monitored that is learned by monitoring the network traffic.