SYSTEM AND METHOD FOR ASSIGNING NETWORK BLOCKS TO SENSORS

• US 20130173790A1
• Filed: 02/28/2013
• Published: 07/04/2013
• Est. Priority Date: 06/11/2010
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Polley, Jonathan, Vogel, William Andrew III
• Granted Patent: US 9,110,905 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies

Abstract

A system includes a processor device. The processor device is configured to detect a physical topology of a network comprising hosts and sensors in the network. The processor device is also configured to generate a sensor policy for assignment of the sensors to network blocks of the hosts, that balances a processing load and accuracy of the sensors in the network based on physical closeness of the sensors to different divisions of hosts within a same network block.

Claims

1. A computer system, comprising:

a processor and memory configured to

detect a physical topology of a network comprising hosts and sensors in the network;

iteratively divide and determine different divisions of hosts within a same one of network blocks of the network, the different divisions of hosts within the same one of the network blocks being iteratively divided into smaller divisions of hosts within the network block;

for each of the sensors,

determine physical proximity distances between the sensor and each of the hosts in each of the different divisions of hosts within the same one of network blocks of the network, and

determine which one of the sensors to assign to one of the different divisions of hosts within the same network block of the hosts based on sensor-network block scores balancing (1) which one of the sensors is physically closest to the one of the different divisions of hosts within the same network block as indicated by the determined physical proximity distances and (2) a preference for a larger network block over a smaller network block among the iteratively divided different divisions of hosts within the network block; and

generate a sensor policy that assigns the one of the sensors to monitor the one of the different divisions of hosts within the same network block of the hosts based on the sensor-network block scores.

2. The system of claim 1, further comprising scoring distance between each sensor and hosts within divisions of the same network block.

3. The system of claim 1, wherein the processor is further configured to

scale the sensor-network block scores that are assigned to prefer the larger network block over the smaller network block, when the different divisions of hosts within the network block are iteratively divided into the smaller divisions of hosts within the network block.

4. The system of claim 1, wherein a sensor most suited to monitor the one of the different divisions of hosts is determined by recursively determining smaller and smaller divisions of hosts within the network block and determining which of the sensors has an overall shortest physical distance, as indicated by the sensor-network block scores, to each one of the smaller and smaller divisions of the network block.

5. The system of claim 1, further comprising transmitting the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

6. The system of claim 1, further comprising displaying the sensor policy for assignment of the sensors, on a display to a user for acceptance of the sensor policy.

7. A method, comprising:

in a processor device;

detecting a physical topology of a network comprising hosts and sensors in the network;

iteratively dividing and determining different divisions of hosts within a same one of network blocks of the network, the different divisions of hosts within the same one of the network blocks being iteratively divided into smaller divisions of hosts within the network block;

for each of the sensors,

determining physical proximity distances between the sensor and each of the hosts in each of the different divisions of hosts within the same one of network blocks of the network, and

determining which one of the sensors to assign to one of the different divisions of hosts within the same network block of the hosts based on sensor-network block scores balancing (1) which one of the sensors is physically closest to the one of the different divisions of hosts within the same network block as indicated by the determined physical proximity distances and (2) a preference for a larger network block over a smaller network block among the iteratively divided different divisions of hosts within the network block; and

generating a sensor policy that assigns the one of the sensors to monitor the one of the different divisions of hosts within the same network block of the hosts based on the sensor-network block scores.

8. The method of claim 7, further comprising scoring distance between each sensor and hosts within divisions of the same network block.

9. The method of claim 7, further comprising

scaling the sensor-network block scores that are assigned to prefer the larger network block over the smaller network block, when the different divisions of hosts within the network block are iteratively divided into the smaller divisions of hosts within the network block.

10. The method of claim 7, further comprising determining a sensor most suited to monitor the one of the different divisions of hosts by recursively determining smaller and smaller divisions of hosts within the network block and determining which of the sensors has an overall shortest physical distance, as indicated by the sensor-network block scores, to each one of the smaller and smaller divisions of the network block.

11. The method of claim 7, further comprising transmitting the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

12. The method of claim 7, further comprising displaying the sensor policy for assignment of the sensors, on a display to a user for acceptance of the sensor policy.

13. A controller configured to perform the method of claim 7.

14. A non-transitory computer readable medium comprising executable instructions for performing the method of claim 7.

15. A non-transitory computer-readable storage medium comprising non-transitory computer-executable instructions for performing the steps of:

detecting a physical topology of a network comprising hosts and sensors in the network;

iteratively dividing and determining different divisions of hosts within a same one of network blocks of the network, the different divisions of hosts within the same one of the network blocks being iteratively divided into smaller divisions of hosts within the network block;

for each of the sensors,

determining physical proximity distances between the sensor and each of the hosts in each of the different divisions of hosts within the same one of network blocks of the network, and

determining which one of the sensors to assign to one of the different divisions of hosts within the same network block of the hosts based on sensor-network block scores balancing (1) which one of the sensors is physically closest to the one of the different divisions of hosts within the same network block as indicated by the determined physical proximity distances and (2) a preference for a larger network block over a smaller network block among the iteratively divided different divisions of hosts within the network block; and

generating a sensor policy that assigns the one of the sensors to monitor the one of the different divisions of hosts within the same network block of the hosts based on the sensor-network block scores.

16. The non-transitory storage medium of claim 15, further comprising scoring distance between each sensor and hosts within divisions of the same network block.

17. The non-transitory storage medium of claim 15, further comprising

scaling the sensor-network block scores that are assigned to prefer the larger network block over the smaller network block, when the different divisions of hosts within the network block are iteratively divided into the smaller divisions of hosts within the network block.

18. The non-transitory storage medium of claim 15, further comprising determining a sensor most suited to monitor the one of the different divisions of hosts by recursively determining smaller and smaller divisions of hosts within the network block and determining which of the sensors has an overall shortest physical distance, as indicated by the sensor-network block scores, to each one of the smaller and smaller divisions of the network block.

19. The non-transitory storage medium of claim 15, further comprising transmitting the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

20. The non-transitory storage medium of claim 15, further comprising displaying the sensor policy for assignment of the sensors, on a display to a user for acceptance of the sensor policy.