Apparatus, System, and Method for Enhanced Monitoring and Searching of Devices Distributed Over a Network

• US 20140164609A1
• Filed: 12/04/2013
• Published: 06/12/2014
• Est. Priority Date: 12/07/2012
• Status: Active Grant

• Current Assignee: Cpacket Networks Incorporated
• Original Assignee: Cpacket Networks Incorporated
• Inventors: Kay, Rony
• Granted Patent: US 10,069,704 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system for network monitoring and network traffic analysis includes a plurality of network devices and a management station. Each of the plurality of network devices is associated with corresponding ones of a plurality of ports. Each of the plurality of network devices is configured to determine network traffic analysis data associated with a characteristic of network data traversing each of the plurality of ports. The management station is configured to determine a ranking of the plurality of ports based on the network traffic analysis data in response to a search request implicating the characteristic, and is configured to display the plurality of ports based on the ranking.

Claims

1. A system for network monitoring and network traffic analysis, comprising:

a plurality of network devices, each of the plurality of network devices being associated with corresponding ones of a plurality of ports, each of the plurality of network devices being configured to determine network traffic analysis data associated with a characteristic of network data traversing each of the plurality of ports; and

a management station configured to determine a ranking of the plurality of ports based on the network traffic analysis data in response to a search request implicating the characteristic, and configured to display the plurality of ports based on the ranking.

2. The system of claim 1, wherein the management station is configured to refresh the display of the plurality of ports upon a change in the ranking due to dynamic variations in the traffic analysis data.

3. The system of claim 1, wherein the ranking of the plurality of ports is based on whether the network data traversing the each of the plurality of ports has the characteristic.

4. The system of claim 1, wherein the ranking of the plurality of ports is based on a number of times that the characteristic has been detected in the network data over a time interval.

5. The system of claim 4, wherein the characteristic is indicated based on an occurrence of a bit pattern in the network data.

6. The system of claim 4, wherein the characteristic is indicated based on an occurrence of a pattern of variation in a data rate associated with the network data.

7. The system of claim 1, wherein the each of the plurality of network devices is configured to determine the network traffic analysis data based on application of at least one of a signature-based rule and a behavioral rule to the network data.

8. The system of claim 1, wherein:

the each of the plurality of network devices is configured to determine statistical data over each of a plurality of time intervals of a first time granularity based on the network data; and

the network traffic analysis data has a volume reduced from a volume of the statistical data; and

the each of the plurality of network devices is configured to determine the network traffic analysis data based on performance of a mathematical operation on the statistical data, wherein the network traffic analysis data is associated with each of a plurality of time intervals of a second time granularity, the first time granularity being finer than the second time granularity.

9. The system of claim 8, wherein the mathematical operation includes at least one of a minimum, a maximum, and an average.

10. The system of claim 8, wherein:

the network traffic analysis data includes a maximum of the statistical data over the each of the plurality of time intervals of the second time granularity; and

the characteristic of the network data is indicated by the maximum of the statistical data over at least one of the plurality of time intervals of the second time granularity substantially exceeding the average of the statistical data over the at least one of the plurality of time intervals of the second time granularity.

11. The system of claim 1, wherein the each of the plurality of network devices is configured to determine the network traffic analysis data based on performance of a mathematical operation on at least one of statistics and rule-based information associated with the network data, wherein the mathematical operation includes at least one of a convolution, a moving average, a sum of squares, a linear filtering operation, and a nonlinear filtering operation.

12. The system of claim 11, wherein the ranking of the plurality of ports is based on a result of the mathematical operation on the network data.

13. The system of claim 1, wherein each of the plurality of network devices is configured to generate an alert indication associated with the corresponding ones of the plurality of ports based on detection of the characteristic in the network data traversing the corresponding ones of the plurality of ports by the each of the plurality of network devices.

14. The system of claim 13, wherein the ranking of the plurality of ports is based on whether the alert indication is present for the each of the plurality of ports.

15. A system, comprising:

a plurality of first devices, each of the plurality of first devices being configured with a corresponding set of ports included in a plurality of ports, wherein each of the plurality of first devices is configured to determine second data based on first data associated with each of the corresponding set of ports; and

a second device coupled to the plurality of first devices over a network, the second device being configured to search the plurality of ports based on an input search criterion, to rank at least two of the plurality of ports based on the second data and the input search criterion, and to display the at least two of the plurality of ports in ranked order.

16. The system of claim 15, wherein the second device is configured to re-display the at least two of the plurality of ports upon a change in the ranked order of the plurality of ports due to dynamic variations in the first data.

17. The system of claim 15, wherein:

the each of the plurality of first devices is configured to determine the second data based on applying at least one of a signature-based rule and a behavioral rule to the first data; and

the input search criterion is associated with the at least one of the signature-based rule and the behavioral rule.

18. The system of claim 15, wherein:

the each of the plurality of first devices is configured to determine the second data based on applying a rule associated with variation in traffic volume associated with at least one of the corresponding set of ports; and

the input search criterion is associated with the rule.

19. The system of claim 15, wherein:

the each of the plurality of first devices is configured to determine statistical data over each of a plurality of time intervals of a first time granularity based on the first data; and

the second data has a volume reduced from a volume of the statistical data; and

the each of the plurality of network devices is configured to determine the second data based on performance of a mathematical operation on the statistical data, wherein the second data is associated with each of a plurality of time intervals of a second time granularity, the first time granularity being finer than the second time granularity.

20. The system of claim 19, wherein the mathematical operation includes at least one of a minimum, a maximum, and an average.