Internet Monitoring and Alerting System

• US 20130326616A1
• Filed: 10/17/2012
• Published: 12/05/2013
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: New Mexico Technical Research Foundation
• Original Assignee: New Mexico Technical Research Foundation
• Inventors: Planck, Max Wilhelm, Colbaugh, Richard David, Glass, Kristin Lea, Willard, Gerald Neal, Thiess, Michelle Denise, Ackley, Darryl Mackinnon, Pollard, Isis Rose, Mattax, Jason Paul, Barber, Brandon Michael, Shepard, Noah Michael
• Granted Patent: US 9,032,518 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A monitoring and alerting system for detecting a disruptive event on the Internet includes a data collection and wrapping module configured to process input data that includes messages produced by a network routing protocol, including a live stream of messages on the network, historical dumps of the message to a computer'"'"'s file system, or both. An automated analysis engine includes analysis modules configured to analyze routing information and selected Internet behaviors from the input data. User output includes automated alerts to the user and an interactive analysis module. The analysis modules include a probabilistic origin hijack analysis module; a probabilistic route hijack analysis module; a Hidden Markov Model analysis module; a tensor decomposition and analysis module and a static topology analysis module; and a dynamic topology analysis module.

Claims

1. A monitoring and alerting system for detecting a disruptive event on the Internet, comprising:

a data collection and wrapping module configured to process input data, said input data including a plurality of messages produced by a network routing protocol on a selected network, wherein said input data comprises a live stream of said messages on said network, historical dumps of said messages to a computer'"'"'s file system, or both;

an automated analysis engine, said automated analysis engine comprising a plurality of analysis modules configured to analyze routing information and selected Internet behaviors from said input data; and

user output, wherein said user output includes automated alerts to said user and an interactive analysis module.

2. The system according to claim 1, wherein said plurality of analysis modules includes a probabilistic origin hijack analysis module configured to detect unexpected changes in a selected Internet prefix by retaining a recent history of routing information pertaining to each prefix;

a probabilistic route hijack analysis module configured to analyze routing information from an entire route by calculating probabilities for adjacent pairs of nodes being seen in a route from historic information;

a Hidden Markov Model analysis module configured to observe behaviors of the Internet as represented by routing data taken in as input;

a tensor decomposition and analysis module and a static topology analysis module, each configured to apply a plurality of graphical metrics to a selected Internet topology; and

a dynamic topology analysis module configured to form change graphs and to track characteristics representing changes in the Internet topology.

3. The system according to claim 1, further comprising a download management system configured to operate with directory structures of selected data sources.

4. The system according to claim 3, wherein said download management system comprises a plurality of execution threads.

5. The system according to claim 4, wherein said plurality of execution threads includes an overall manager thread, a year-month manager thread, and a raw file downloading thread, wherein said overall manager thread is configured to monitor a data source of addition of new monthly data, make month entries in a database, a create directories for new data, and delegate to said year-month manager thread continuation of collection of new data, wherein said year-month manager is configured to monitor for new data files, make new database entries for individual data files, and delegate to said raw file downloading thread retrieval from one of said data file, and wherein the raw file downloader thread is configured to retrieve the data file, retry failed downloads, and report results by updating a selected file entry in said database.

6. The system according to claim 1, wherein the automated alerts include information regarding a time, a classification, and a location of the disruptive event.

7. The system according to claim 1, wherein said alerts are automatically generated and distributed through email.

8. The system according to claim 1, wherein said alerts include information regarding severity of the disruptive event;

the metric of label model fit for a type of the event;

Logical Localization information as to an entity involved in the event;

metrics to rank involved entities based on associated topology community; and

links to relevant portal analysis pages that detail the event.

9. The system according to claim 1, wherein the alerts are produced in near real-time.

10. A method for monitoring the Internet for disruptive events and alerting a user as to the disruptive events, comprising the steps of:

providing a data collection and wrapping module;

processing with said data collection and wrapping module input data, said input data including a plurality of messages produced by a network routing protocol on a selected network, wherein said input data comprises a live stream of said messages on said network, historical dumps of said message to a computer'"'"'s file system, or both;

providing an automated analysis engine, said automated analysis engine comprising a plurality of analysis modules;

analyzing routing information and selected Internet behaviors from said input data with said automated analysis engine; and

generating user output, wherein said user output includes automated alerts to said user and an interactive analysis module.

11. The method according to claim 10, wherein said plurality of analysis modules includes a probabilistic origin hijack analysis module configured to detect unexpected changes in a selected Internet prefix by retaining a recent history of routing information pertaining to each prefix;

a probabilistic route hijack analysis module configured to analyze routing information from an entire route by calculating probabilities for adjacent pairs of nodes being seen in a route from historic information;

a Hidden Markov Model analysis module configured to observe behaviors of the Internet as represented by routing data taken in as input;

a tensor decomposition and analysis module and a static topology analysis module, each configured to apply a plurality of graphical metrics to a selected Internet topology; and

a dynamic topology analysis module configured to form change graphs and to track characteristics representing changes in the Internet topology.

12. The system according to claim 10, further comprising providing a download management system configured to operate with directory structures of selected data sources.

13. The system according to claim 12, wherein said download management system comprises a plurality of execution threads.

14. The system according to claim 13, wherein said plurality of execution threads includes an overall manager thread, a year-month manager thread, and a raw file downloading thread, wherein said overall manager thread is configured to monitor a data source of addition of new monthly data, make month entries in a database, a create directories for new data, and delegate to said year-month manager thread continuation of collection of new data, wherein said year-month manager is configured to monitor for new data files, make new database entries for individual data files, and delegate to said raw file downloading thread retrieval from one of said data file, and wherein the raw file downloader thread is configured to retrieve the data file, retry failed downloads, and report results by updating a selected file entry in said database.

15. The system according to claim 10, wherein the automated alerts include information regarding a time, a classification, and a location of the disruptive event.

16. The system according to claim 10, wherein said alerts are automatically generated and distributed through email.

17. The system according to claim 10, wherein said alerts include information regarding severity of the disruptive event;

the metric of label model fit for a type of the event;

Logical Localization information as to an entity involved in the event;

metrics to rank involved entities based on associated topology community; and

links to relevant portal analysis pages that detail the event.

18. The system according to claim 10, further comprising producing the alerts in near real-time.