Enterprise network analyzer zone controller system and method

• US 7,154,857 B1
• Filed: 12/21/2001
• Issued: 12/26/2006
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Joiner, Herbert V., Elwell, Ken W.
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): TRAN, PHUC H
• Application Number:
  US10/029,616
• Time in Patent Office: 1,831 Days
• Field of Search: 370229-235, 370503-520, 370241-251, 709/223, 709/224, 709/227, 709/235, 709/230, 709/248, 713151-162, 713201-203
• US Class Current: 370/245
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system, method and computer program product are provided for analyzing a network utilizing a zone controller. Initially, network traffic information is received from a plurality of host controllers. Further, the network traffic information is reported upon utilizing a plurality of network-based interfaces. The host controllers are related to a zone for facilitating the reporting.

Claims

1. A method for analyzing a network utilizing a zone controller, comprising:

receiving network traffic information from a plurality of host controllers;

reporting on the network traffic information utilizing a plurality of network-based interfaces;

generating a map of a network based on the network traffic-information; and

providing intrusion detection services based on network traffic information;

wherein the host controllers are related to a zone.

2. The method as recited in claim 1, and further comprising synchronizing a clock with the host controllers.

3. The method as recited in claim 1, wherein the network traffic information is originally collected by a plurality of agents coupled to the host controllers.

4. The method as recited in claim 3, wherein the network traffic information is collected from a plurality of zone controllers coupled to the host controllers.

5. The method as recited in claim 4, wherein the intrusion detection services are performed by the host controllers and the zone controllers.

6. The method as recited in claim 4, wherein the host controllers and the zone controllers operate based on user-configurable business rules.

7. The method as recited in claim 1, and further comprising identifying a zone associated with each of the host controllers.

8. The method as recited in claim 7, and further comprising reporting on the network traffic information relating to each of the zones.

9. The method as recited in claim 8, wherein a fee associated with the reporting is determined based on a number of agents, the host controllers, and zone controllers.

10. The method as recited in claim 9, wherein the fee is reoccurring.

11. The method as recited in claim 8, wherein a report is generated including a plurality of objects in a tree representation.

12. The method as recited in claim 1, and further comprising receiving a plurality of the maps from the host controllers.

13. The method as recited in claim 12, and further comprising reporting on the network traffic information utilizing the maps.

14. The method as recited in claim 1, and further comprising offloading the network traffic information to a database.

15. The method as recited in claim 1, wherein the map includes a correlation among computers of the network and the network traffic information associated therewith.

16. The method as recited in claim 1, wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

17. The method as recited in claim 1, wherein the intrusion detection services include scanning the network traffic information and detecting intrusions in the network based on the scanned network traffic information.

18. A computer program product for analyzing a network utilizing a zone controller, comprising:

computer code for receiving network traffic information from a plurality of host controllers;

computer code for reporting on the network traffic information utilizing a plurality of network-based interfaces;

computer code for generating a map of a network based on the network traffic-information; and

computer code for providing intrusion detection services based on network traffic information;

wherein the host controllers are related to a zone.

19. The computer program product as recited in claim 18, and further comprising computer code for synchronizing a clock with the host controllers.

20. The computer program product as recited in claim 18, wherein the network traffic information is originally collected by a plurality of agents coupled to the host controllers.

21. The computer program product as recited in claim 18, and further comprising computer code for identifying a zone associated with each of the host controllers.

22. The computer program product as recited in claim 21, and further comprising computer code for reporting on the network traffic information relating to each of the zones.

23. The computer program product as recited in claim 18, and further comprising computer code for receiving a plurality of the maps from the host controllers.

24. The computer program product as recited in claim 23, and further comprising computer code for reporting on the network traffic information utilizing the maps.

25. The computer program product as recited in claim 18, and further comprising computer code for offloading the network traffic information to a database.

26. A system for analyzing a network utilizing a zone controller, comprising:

logic for receiving network traffic information from a plurality of host controllers;

logic for reporting on the network traffic information utilizing a plurality of network-based interfaces;

logic for generating a map of a network based on the network traffic-information; and

logic for providing intrusion detection services based on network traffic information;

wherein the host controllers are related to a zone.

27. The system as recited in claim 26, and further comprising logic for synchronizing a clock with the host controllers.

28. The system as recited in claim 26, wherein the network traffic information is originally collected by a plurality of agents coupled to the host controllers.

29. The system as recited in claim 26, and further comprising logic for identifying a zone associated with each of the host controllers.

30. The system as recited in claim 29, and further comprising logic for reporting on the network traffic information relating to each of the zones.

31. The system as recited in claim 26, and further comprising logic for receiving a plurality of the maps from the host controllers.

32. The system as recited in claim 31, and further comprising logic for reporting on the network traffic information utilizing the maps.

33. The system as recited in claim 26, and further comprising logic for offloading the network traffic information to a database.

34. A system for analyzing a network utilizing a zone controller, comprising:

means for receiving network traffic information from a plurality of host controllers;

means for reporting on the network traffic information utilizing a plurality of network-based interfaces;

means for generating a map of a network based on the network traffic-information; and

means for providing intrusion detection services based on network traffic information;

wherein the host controllers are related to a zone.

35. A method for analyzing a network utilizing a zone controller, comprising:

(a) synchronizing a clock with a plurality of host controllers;

(b) receiving network traffic information from the host controllers;

identifying a zone associated with each of the host controllers;

(d) receiving maps from the host controllers;

(e) reporting on the network traffic information relating to each of the zones utilizing a plurality of network-based interfaces and the maps;

(f) offloading the network traffic information to a database;

(g) generating a map of a network based on the network traffic-information; and

(h) providing intrusion detection services based on network traffic information.