System, method and computer program product for processing network accounting information

• US 7,099,940 B2
• Filed: 08/07/2001
• Issued: 08/29/2006
• Est. Priority Date: 08/07/2000
• Status: Expired due to Term

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Ltd.
• Original Assignee: Amdocs Ltd.
• Inventors: Givoly, Tal
• Primary Examiner(s): Tran, Philip B.
• Application Number:
  US09/924,391
• Publication Number:
  US 20020089936A1
• Time in Patent Office: 1,848 Days
• Field of Search: 709223-224, 709200-202, 709/238, 713/201, 705/1
• US Class Current: 709/224
• CPC Class Codes: G06Q 50/60 Business processes related to postal services shipping G06Q10/083; franking apparatus G07B17/00
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system, method and computer program product are provided for processing network accounting information. First, accounting information is received utilizing a packet-switched network. During use, at least one aspect of the received accounting information is monitored. In order to provide a defense against network attacks, dealing with heavy network traffic, or any other type of surge of network events, at least a portion of the accounting information is discarded and/or aggregated based on the monitored aspect. This prevents a system from being overloaded during the network accounting process.

Claims

1. A computer-implemented method for processing network accounting information, comprising:

receiving accounting information over a packet-switched network;

monitoring at least one aspect of the received accounting information;

discarding at least a portion of the accounting information that occurs during a surge in network traffic, based on the at least one monitored aspect, after receiving the accounting information;

processing at least a portion of the accounting information prior to passing to subsequent accounting processing, based on at least one attribute of the accounting information, after receiving the accounting information; and

allowing at least a portion of remaining accounting information to pass to the subsequent accounting processing, after receiving the accounting information;

wherein the portion of the accounting information is discarded to prevent an overload of the subsequent accounting processing.

2. The method as recited in claim 1, wherein the accounting information is discarded for dealing with heavy network traffic.

3. The method as recited in claim 2, and further comprising generating a summary of the accounting information.

4. The method as recited in claim 1, wherein monitoring the at least one aspect of the received accounting information includes detecting a scan of a plurality of ports.

5. The method as recited in claim 1, wherein monitoring the at least one aspect of the received accounting information includes monitoring a rate of receipt of the accounting information.

6. The method as recited in claim 5, wherein monitoring the, at least one aspect of the received accounting information includes detecting whether the rate of receipt of the accounting information exceeds a predetermined amount.

7. The method as recited in claim 1, wherein monitoring the at least one aspect of the received accounting information includes monitoring a load on a system receiving the accounting information.

8. The method as recited in claim 1, wherein the network includes the Internet.

9. The method as recited in claim 1, wherein the processing includes processing selected from the group consisting of aggregating, summarizing, and accounting.

10. The method as recited in claim 1, wherein the processing includes processing selected from the group consisting of aggregating and summarizing.

11. A computer program product embodied on a computer readable storage medium having computer code embodied therein for processing network accounting information, comprising:

computer code for receiving accounting information over a packet-switched network;

computer code for monitoring at least one aspect of the received accounting information;

computer code for processing at least a portion of the accounting information prior to passing to subsequent accounting processing , based on at least one attribute of the accounting information, after receiving the accounting information;

computer code for discarding at least a portion of the accounting information that occurs during a surge in network traffic and is expendable, based on the at least one monitored aspect, after receiving the accounting information; and

computer code for allowing at least a portion of remaining accounting information to pass to the subsequent accounting processing, after receiving the accounting information;

wherein the portion of the accounting information is discarded to prevent an overload of the subsequent accounting processing.

12. The computer program product as recited in claim 11, wherein the accounting information is discarded for dealing with heavy network traffic.

13. The computer program product as recited in claim 12, and further comprising computer for generating a summary of the accounting information.

14. The computer program product as recited in claim 11, wherein the computer code for monitoring the at least one aspect of the received accounting information includes computer code for monitoring a rate of receipt of the accounting information.

15. The computer program product as recited in claim 14, wherein the computer code for monitoring the at least one aspect of the received accounting information includes computer code for detecting whether the rate of receipt of the accounting information exceeds a predetermined amount.

16. The computer program product as recited in claim 11, wherein the computer code for monitoring the at least one aspect of the received accounting information includes computer code for detecting a scan of a plurality of ports.

17. The computer program product as recited in claim 11, wherein the computer code for monitoring the at least one aspect of the received accounting information includes computer code for monitoring a load on a system receiving the accounting information.

18. A computer program product embodied on a computer readable storage medium having computer code embodied therein for processing network accounting information, comprising:

computer code for receiving accounting information over a packet-switched network;

computer code for identifying at least one aspect of the received accounting information;

computer code for processing at least a portion of the accounting information prior to passing to subsequent accounting processing, based on at least one attribute associated with the accounting information, after receiving the accounting information;

computer code for discarding at least a portion of the accounting information that occurs during a surge in network traffic, based on the at least one identified aspect, after receiving the accounting information; and

computer code for allowing at least a portion of remaining accounting information to pass to the subsequent accounting processing, after receiving the accounting information;

wherein, the portion of the accounting information is discarded to prevent an overload of the subsequent accounting processing.

19. A computer-implemented method for processing network accounting information, comprising:

receiving accounting information over a packet-switched network;

identifying at least one aspect of the received accounting information;

processing at least a portion of the accounting information prior to passing to subsequent accounting processing, based on at least one attribute of the accounting information, after receiving the accounting information;

discarding at least a portion of the accounting information that occurs during a surge in network traffic, based on the at least one identified aspect, after receiving the accounting information; and

allowing at least a portion of remaining accounting information to pass to the subsequent accounting processing, after receiving the accounting information;

wherein the portion of the accounting information is discarded to prevent an overload of the subsequent accounting processing.