PACKET CAPTURE AND NETWORK TRAFFIC REPLAY

• US 20150135325A1
• Filed: 11/13/2013
• Published: 05/14/2015
• Est. Priority Date: 11/13/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: ProtectWise, Inc. (Verizon Communications Inc.)
• Inventors: Stevens, Gene, Chasin, Scott
• Granted Patent: US 9,516,049 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Implementations disclosed herein provide a network agent embodied in firmware and/or software that replays network traffic of an enterprise network to an entity outside of the enterprise network. The network agent selects and processes the network traffic according to certain policies set by the enterprise network or a third party security management system. These policies allow for a capture and replay of high-integrity data that enables threat analysis.

Claims

1. One or more tangible computer-readable storage media encoding computer-executable instructions for executing on a computer system a computer process, wherein the computer-readable storage media is not a carrier wave or propagating signal and the computer process further comprises:

intercepting network traffic of an enterprise network directed to a target destination;

replaying the intercepted network traffic outside of the enterprise network to an end destination other than the target destination.

2. The one or more computer-readable storage media of claim 1, wherein the replay operation is a passive replay operation further comprising:

copying the intercepted network traffic; and

transmitting the copied network traffic outside of the enterprise network.

3. The one or more computer-readable storage media of claim 1, wherein the replay operation further comprises:

replaying the network traffic in real-time.

4. The one or more computer-readable storage media of claim 1, wherein the replay operation further comprises:

replaying the network traffic on a periodic basis.

5. The one or more computer-readable storage media of claim 1, wherein the replay operation further comprises:

replaying a filtered subset of all monitored network traffic on the enterprise network.

6. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

selecting the network traffic for replay based on policies specified by an entity external to the enterprise network.

7. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

processing the network traffic based on policies specified by an entity external to the enterprise network.

8. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

adaptively altering a data selection policy based on collective network intelligence of a third-party security service external to the enterprise network.

9. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

adaptively altering a data transmission preparation policy based on collective network intelligence of a third-party security service.

10. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

taking a remediative action responsive to a notification based on collective network intelligence of a security service external to the enterprise network.

11. The one or more computer-readable storage media of claim 1, wherein the computer process further comprises:

transmitting a communication to a first agent of an enterprise network, the communication instructing the first agent to perform a first part of a replay task; and

performing, at a second agent of the enterprise network, a different part of the replay task.

12. A system comprising:

memory coupled to a processor;

a network agent configured to utilize the processor to intercept network traffic of an enterprise network destined to a target location and replay the network traffic outside of the enterprise network to an end destination other than the target destination.

13. The system of claim 12, wherein the network agent is configured to passively replay the network traffic by copying the intercepted network traffic and transmitting the copied network traffic outside of the enterprise network.

14. The system of claim 12, wherein the network agent is configured to replay the network traffic in real-time.

15. The system of claim 12, wherein the network agent is configured to replay a filtered subset of all network traffic on the enterprise network.

16. The system of claim 12, wherein the network agent selects network traffic for the replay based on policies specified by an entity external to the enterprise network.

17. The system of claim 12, wherein the network agent processes the network traffic based on policies specified by an entity external to the enterprise network.

18. The system of claim 12, further comprising:

a managed security service external to the enterprise network, the managed security service configured to adaptively alter a data selection policy of the network agent based on collective network intelligence.

19. The system of claim 12, wherein the network agent is further configured to take remediative action responsive to notification of a security threat, the notification based on collective network intelligence of a security service external to the enterprise network.

20. The system of claim 12, wherein the network agent is configured to perform a first part of a replay task and transmit a communication instructing another network agent to perform a second part of the replay task.

21. The system of claim 12, wherein the network agent replays a bundle of data packets within one second of receiving the data packets.