AUTOMATIC PROVISIONING OF NEW USERS OF INTEREST FOR CAPTURE ON A COMMUNICATION NETWORK

• US 20120259975A1
• Filed: 12/22/2011
• Published: 10/11/2012
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: SS8 Networks Incorporated
• Original Assignee: SS8 Networks Incorporated
• Inventors: LE, ROBERT, Bean, Timothy, Mctiernan, Kevin
• Granted Patent: US 8,938,534 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. A metadata portion of at least one of the data streams is analyzed on the network and evaluated using a metadata processing engine to identify a relationship between at least two of the plurality of data streams, e.g., a relationship between multiple users of a network, regardless of whether the users are currently of interest or if they are not of interest. An interface manager can receive an information of a new user of interest, evaluate the new user of interest for redundancy against existing known users of interest of the NMS; then communicate the information of the new user of interest to at least one access device to collect data streams associated with the new user of interest.

Claims

1. A network monitoring system comprising:

a metadata processing device operative to;

receive a metadata portion of a data stream from a user not currently of interest in a network;

evaluate the metadata portion of the data stream; and

create a relationship between the metadata portion of the data stream of the user not currently of interest and any data of a known user of interest.

2. The network monitoring system of claim 1 wherein the metadata processing device is operative to receive a metadata portion of all data streams in the network for analysis.

3. The network monitoring system of claim 1 wherein the metadata portion of the data stream is evaluated for metrics.

4. The network monitoring system of claim 1 wherein the evaluation of the metadata from the user not currently of interest occurs in parallel to evaluation of data from the known user of interest.

5. The network monitoring system of claim 1 wherein the metadata processing device is further operative to:

receive a known user metadata value; and

seek a metadata value associated with a user not currently of interest that has a relationship to the known user'"'"'s metadata value.

6. The network monitoring system of claim 5 wherein the known user metadata value is not previously known.

7. The network monitoring system of claim 1 wherein the metadata processing device is operative to transmit the metadata portion of the data stream from the user not currently of interest to a graphical user interface (GUI) for analysis.

8. The network monitoring system of claim 1 wherein the metadata processing device is operative to identify the user not currently of interest as a new user of interest based on the relationship of the metadata associated with the user not currently of interest to any data of the known user of interest.

9. A method of monitoring data, the method comprising:

receiving at a metadata processing device, a metadata portion of a data stream from a user not currently of interest in a network;

evaluating the metadata portion of the data stream; and

creating a relationship between the metadata portion of the data stream of the user not currently of interest and any data of a known user of interest.

10. The method of claim 9 wherein the metadata processing device receives a metadata portion of all data streams in the network for analysis.

11. The method of claim 9 wherein the metadata portion of the data stream is evaluated for metrics.

12. The method of claim 9 wherein the metadata associated with the user not currently of interest is received and evaluated automatically without input from an analyst.

13. The method of claim 9 wherein the evaluation of the metadata from the user not currently of interest occurs in parallel to evaluation of data from a known user of interest.

14. The method of claim 9 wherein the metadata processing device is further operative to:

receiving a known user metadata value; and

seeking a metadata value associated with a user not currently of interest that has a relationship to the known user metadata value.

15. The method of claim 9 wherein the metadata processing device is operative to:

identifying the user not currently of interest as a new user of interest based on the relationship of the metadata of the user not currently of interest to any data of the known user of interest.

16. A network monitoring system comprising:

an access device for retrieving data from a network;

a metadata processing engine coupled to the access device, wherein the metadata processing engine determines a new user of interest using metadata from a user not currently of interest of the network, and wherein the metadata processing engine is operative to;

retrieve the data to be monitored from the network;

evaluate the data retrieved from the network;

create a new user of interest on the network based on the evaluation of the data retrieved from the network;

communicate an identification (ID) for the new user of interest to the access device; and

monitor the network for data related to the new user of interest.

17. The network monitoring system of claim 16 wherein the data retrieved from the network to create the new user of interest is metadata that is evaluated at the metadata processing engine.

18. The network monitoring system of claim 16 wherein the metadata processing engine is further operative to:

evaluating the data of the new user of interest obtained from the network.

19. The network monitoring system of claim 16 wherein the portion of the method for creating the new user of interest on the network is performed automatically without an approval from an analyst.

20. The network monitoring system of claim 16 wherein the portion of the method for creating a new user of interest on the network is performed by algorithmic evaluation of the data from the network.

21. The network monitoring system of claim 16 wherein the evaluating portion of the method comprises:

constructing a link between the user not currently of interest and the known user of interest based on metadata associated with the user not currently of interest and based on any data of the known user of interest.

22. The network monitoring system of claim 20 wherein the metadata processing engine is further operative to:

changing a status of a user ID from that of a user not currently of interest to that of a new user of interest;

updating the access device with the new user of interest to be monitored; and

communicating the new user ID of the new user of interest to be monitored on the network.

23. The network monitored system of claim 22 wherein the metadata processing engine is further operative to:

notifying an analyst that the new user of interest has been added to the network; and

requesting an approval from the analyst for the changing of the status.

24. The network monitoring system of claim 23 wherein the metadata processing engine is further operative to:

withdrawing the new user of interest from being monitored on the network if the analyst disapproves of the new user of interest; and

changing the status of the user ID of the new user of interest to that of a user not currently of interest.

25. A method of provisioning a user to be monitored in a network, the method comprising:

retrieving data to be monitored from the network;

evaluating the data retrieved from the network;

creating a new user of interest on the network based on the evaluating of the data retrieved from the network;

communicating an identification (ID) for the new user of interest to the access device; and

monitoring the network for data related to the new user of interest.

26. The method of provisioning of claim 25 wherein the data retrieved from the network to create the new user of interest is metadata that is evaluated at a metadata processing engine coupled to the access device.

27. The method of provisioning of claim 25 further comprising:

evaluating the data of the new user of interest obtained from the network.

28. The method of provisioning of claim 25 wherein the portion of the method for creating the new user of interest on the network is performed automatically without an approval from an analyst.

29. The method of provisioning of claim 25 wherein the portion of the method for creating the new user of interest on the network is performed by algorithmic evaluation of the data from the network.

30. The method of provisioning of claim 25 wherein the evaluating portion of the method comprises:

constructing a link between the user not currently of interest and the known user of interest based on metadata associated with the user not currently of interest and based on any data of the known user of interest.

31. The method of provisioning of claim 29 further comprising:

changing a status of a user ID from that of a user not currently of interest to that of a new user of interest;

updating the access device with the status of the new user of interest; and

communicating the user ID of the new user of interest on the network.

32. The method of provisioning of claim 25 further comprising:

notifying an analyst that the new user of interest has been added to the network; and

requesting an approval from the analyst.

33. The method of provisioning of claim 32 further comprising:

withdrawing the new user of interest from being monitored on the network if the analyst disapproves of the new user of interest; and

changing the status of the new user of interest to that of a user not currently of interest when the analyst disapproves the new user of interest.