Network Flow Monitoring

• US 20150326460A1
• Filed: 05/10/2015
• Published: 11/12/2015
• Est. Priority Date: 05/10/2014
• Status: Active Grant

• Current Assignee: Cyberrock, Inc.
• Original Assignee: Cyberrock, Inc.
• Inventors: Wang, Xinyuan, Li, Zuotao
• Granted Patent: US 9,686,156 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A network flow monitoring and analysis system comprises flow labeling agent(s), sensor(s), controller(s), and correlation engines(s). The flow labeling agent(s) label at data packet flow unique and covert label(s). The sensor(s) observe data packet flow for the unique and covert label(s) and generate examination report(s) from the observations. The examination report(s) comprise information such as: location information; time information; target information; path information; and flow information. The controller(s) communicate instructions to the labeling agent(s) and sensor(s), receive event information and manage the correlation engine(s). The correlation engine(s) correlate information from information such as the target information; event information; path information; and flow information.

Claims

1. A network flow monitoring and analysis system, comprising:

a) at least one flow labeling agent configurable via labeling instructions to label at least part of a data packet flow with at least one unique and covert label; and

b) at least one sensor configurable to;

i) observe at least part of the data packet flow for the at least one unique and covert label; and

ii) generate at least one examination report, the at least one examination report comprising sensor data, the sensor data comprising;

(1) location information;

(2) time information;

(3) label information; and

(4) flow information;

c) at least one controller configured to;

i) at least one processor;

ii) at least one communications interface; and

iii) at least one non-transitory computer readable medium comprising instructions configured to cause the at least one processor to;

(1) communicate, via at least one of the at least one communications interface, labeling instructions to at least one of the at least one flow labeling agent;

(2) receive, via at least one of the at least one communications interface, at least one of the at least one examination report from at least one of the at least one sensor; and

(3) receive, via at least one of the at least one communications interface, event information, the event information describing at least one event; and

d) a correlation engine configured to generate correlation information from at least two of the following;

i) at least some of the location information;

ii) at least some of the time information;

iii) at least some of the event information;

iv) at least some of the label information; and

v) at least some of the flow information.

2. The system according to claim 1, wherein the sensor data further comprises at least one of the following:

a) target information; and

b) path information.

3. The system according to claim 1, wherein the label is further configured to be dynamic.

4. The system according to claim 1, wherein the instructions are further configured to cause the at least one processor to invoke the correlation engine upon at least one of the following:

a) receiving at least one of the at least one examination report; and

b) receiving at least some event information.

5. The system according to claim 1, further comprising a bidirectional secured communication infrastructure configured to connect at least one of the following:

a) at least one of the at last one controller and at least one of the at least one flow labeling agent;

b) at least one of the at last one controller and at least one of the at least one sensor; and

c) at least one of the at last one controller and at least one other of the at least one controller.

6. The system according to claim 5, wherein at least part of the bidirectional secured communication infrastructure comprises at least one of the following:

a) the Internet;

b) at least one intranet;

c) at least one wireless network;

d) at least one wired network;

e) at least one cellular network;

f) at least one wide area network;

g) at least one local area network;

h) a shared memory;

i) a wired connection;

j) a wireless connection; and

k) communications bus.

7. The system according to claim 1, further comprising a database configured to store at least one of the following:

a) at least some of the target information;

b) at least some of the event information;

c) at least some label information;

d) at least some of the path information; and

e) at least some of the flow information.

8. The system according to claim 7, wherein the correlation engine is further configured to receive at least two of the following from the database:

a) at least some of the target information;

b) at least some of the event information;

c) at least some of the label information;

d) at least some of the path information; and

e) at least some of the flow information.

9. The system according to claim 1, further comprising a knowledge base configured to store at least some of the correlation information.

10. The system according to claim 9, wherein the correlation engine is further configured to store at least some of the correlation information in the knowledge base.

11. The system according to claim 1, further comprising a controller manager configured to manage at least one of the at least one controller.

12. The system according to claim 11, wherein the controller manager is configured to communicate over at least one network interface with at least one user interface client.

13. The system according to claim 1, wherein the correlation engine is further configured to:

a) temporally sequence the sensor data employing at least some of the time information;

b) geographically sequence the sensor data employing at least some of the location information; and

c) determine a path direction of at least part of the data packet flow from the temporally sequence and geographically sequence.

14. The system according to claim 1, wherein the correlation engine is further configured to generate multiple degrees of correlation, the multiple degrees of correlation comprising:

a) deterministic correlations; and

b) non-deterministic correlations.

15. The system according to claim 1, wherein the correlation engine is further configured to apply one or more damping factors to correlation information, the damping factors set, at least in part, on at least one of the following:

a) time intervals; and

b) percentages of paths overlap; and

c) a combination of the above.

16. The system according to claim 1, wherein the labeling instructions comprise at least one of the following:

a) at least some of the label information;

b) at least some of the flow information;

c) at least some of the controller location;

d) at least some of the label key information;

e) instructions to find a labeled flow;

f) instructions to identify a labeled flow;

g) instructions to label data packets; and

h) instructions to correlate packet flow data.

17. The system according to claim 1, wherein the correlation engine is further configured to generate at least one virtual flow to bridge a gap between at least two correlated flows.

18. The system according to claim 1, wherein the correlation engine is further configured to generate at least one network traffic path if at least one of the following correlations is detected:

a) at least two parts of a data packet flow belong to the same path regardless of their source or destination addresses;

b) at least a portion of a path for at least two parts of a data packet flow overlap;

c) a gap between at least two parts of a data packet flow on a similar path and there is no observed flow bridging the gap;

d) at least two correlating data packet flows that each have a par of at least one correlated target and event;

e) an event is correlated with a specific data packet flow and there is at least one other data packet flow on the same path that is correlated to the event;

f) at least two data packet flows share a common target;

g) an event is correlated with a specific data packet flow and a portion of a path for at least two parts of the data packet flow overlap; and

h) multiple targets correlated with a specific data packet flow have at least two parts of the data packet flow overlap.

19. The system according to claim 1, wherein the correlation engine is further configured to correlate at least one of the following:

a) a data packet flow with an event when the path of the data packet flow includes a target that is correlated with the event;

b) a first data packet flow with an event when the path of the first data packet flow overlaps a second data packet flow path that is correlated with the event;

c) a first data packet flow with a target when the path of the first data packet flow overlaps the path of a second data packet flow that includes the target;

d) a data packet flow with a target when the path of the data packet flow correlates with an event that correlates with the target;

e) an event with a first data packet flow path when the first data packet flow path overlaps a second data packet flow path that is correlated to the event;

f) a first data packet flow with a second data packet flow when at least part of a path for the first data packet flow overlaps at least part of a path for the second data packet flow;

g) a first path and a second path to a target when at least a part of a first data packet flow and at least a part of a second data packet flow comprise at least one of the following;

i) label information originating from the same at least one flow labeling agent; and

ii) share common target information;

h) a first path and a second path to a source when a first end node for at least part of a first data packet flow and a second end node for at least part of a second data packet flow are the same;

i) a first path and a second path to each other when;

i) the first path and the second path are both associated to the same target; and

ii) the start time of the first path and the second path are within a time window measured by a degree of correlation; and

j) a first path and a second path to each other when;

i) the first path and the second path are both associated to the same source; and

ii) the start time of the first path and the second path are within a time window measured by a degree of correlation.

20. The system according to claim 1, wherein the correlation engine is further configured to identify a specific node as a critical node when a count of identified paths that pass through the specific node exceeds a threshold.