Systems and methods for adaptive monitoring with bandwidth constraints

• US 7,355,996 B2
• Filed: 02/06/2004
• Issued: 04/08/2008
• Est. Priority Date: 02/06/2004
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E.
• Primary Examiner(s): Yao; Kwang Bin
• Assistant Examiner(s): Tran; Tung Q.
• Application Number:
  US10/773,896
• Publication Number:
  US 20050174961A1
• Time in Patent Office: 1,523 Days
• Field of Search: 370/230, 370/338, 370/389, 713/153, 713/154, 713/160, 713/162, 455/410, 455/411
• US Class Current: 370/328
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 28/20 Negotiating bandwidth
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]

Abstract

This application is directed to systems and methods for adaptive monitoring of a wireless network with bandwidth constraints. A data unit from a wireless node is received. When a bandwidth constraint is satisfied, the received data unit is buffered. When the bandwidth constraint is not satisfied, the received or buffered data unit is transmitted to a monitoring processor. In some instances, downsampling, data discard and data aggregation can occur during the buffering process.

Claims

1. A method of monitoring a wireless network, the method comprising the steps of:

(a) receiving a data unit from a wireless node;

(b) if a bandwidth constraint is satisfied, buffering the received data unit; and

(c) transmitting the received or buffered data unit to a monitoring processor;

(d) repeating steps (a) through (c) for a plurality of wireless nodes;

(e) selecting the wireless node from the plurality of wireless nodes for a given repetition;

wherein the selecting step is based upon a deterministic selection;

wherein deterministic selection comprises a sequential traversal of the plurality of wireless nodes, a selection based upon amount of buffered data for each wireless node in the plurality of wireless nodes, a selection based upon a threat level for each wireless node in the plurality of wireless nodes or combinations thereof.

2. The method of claim 1, and further comprising the steps of receiving the bandwidth constraint.

3. The method of claim 2, wherein the bandwidth constraint is received from a local data store, a wired network node, a wireless network node, an access point or a sensor.

4. The method of claim 2, and further comprising the step of requesting the bandwidth constraint.

5. The method of claim 1, and further comprising the step of determining the bandwidth constraint.

6. The method of claim 5, wherein the step of determining the bandwidth constraint is based at least in part upon local data, data received from a wired network node, data received from a wireless network node, data received from an access point, data received from a sensor or combinations thereof.

7. The method of claim 1, further comprising a step of downsampling when the bandwidth constraint is satisfied.

8. The method of claim 7, wherein the step of downsampling occurs when a local storage constraint is satisfied.

9. The method of claim 8, wherein the step of downsampling only occurs when the local storage constraint is satisfied.

10. The method of claim 7, wherein the step of downsampling comprises one or more steps selected from the group consisting of:

(i) discarding the received data unit if it is redundant with a previously buffered data unit;

(ii) aggregating the received data unit with a previously buffered data unit;

(iii) discarding the received data unit if it comprises network control data;

(iv) discarding the received data unit if it is associated with a device that has already been observed more frequently than other devices; and

(v) discarding the received data unit if the wireless node is determined to be a low threat node.

11. The method of claim 1, wherein the transmitting step occurs at a rate determined based upon the bandwidth constraint and current bandwidth usage.

12. The method of claim 1, and further comprising the step of repeating steps (a) through (c) for a plurality of received data units from the wireless node.

13. The method of claim 12, wherein the transmitting step occurs at a rate determined based upon the bandwidth constraint and current bandwidth usage.

14. The method of claim 1, wherein the transmitting step occurs at a time based upon whether the bandwidth constraint is satisfied.

15. The method of claim 14, wherein the transmitting step comprises immediately transmitting the received data unit if the bandwidth constraint is not satisfied.

16. The method of claim 14, wherein the transmitting step further comprises transmitting the buffered data unit at a point in time when the bandwidth constraint is not satisfied.

17. One or more computer readable media storing instruction that upon execution by a system processor cause the system processor to monitor a wireless network by performing the methods of any of claims 1 through 16.

18. A system of monitoring a wireless network, the system comprising:

(a) a system data store (SDS) comprising capable of storing wireless data transmitted by a plurality of wireless nodes and configuration information at least comprising a bandwidth constraints;

(b) a wireless receiver capable of receiving one or more data units from the plurality of wireless nodes;

(c) a communication interface allowing communication with a monitoring processor; and

(d) a system processor in communication with the SDS, the wireless receiver and the communication interface, wherein the system processor comprises one or more processing elements configured to;

(i) receive a data unit from the wireless receiver in response to receipt of the data unit by the wireless receiver from a wireless node of the plurality of wireless nodes;

(ii) buffer the received data unit in the SDS if a bandwidth constraint is satisfied;

(iii) immediately transmit the received data unit to the monitoring processor via the communication interface if the bandwidth constraint is not satisfied;

(iv) repeat steps (i) through (iii) for a plurality of received data units, wherein the wireless node of the plurality of wireless nodes is deterministically selected for a given repetition, and wherein deterministically selected comprises a sequential traversal of the plurality of wireless nodes, a selection based upon amount of buffered data for each wireless node in the plurality of wireless nodes, a selection based upon a threat level for each wireless node in the plurality of wireless nodes or combinations thereof;

(v) discard the received data unit if the bandwidth constraint is satisfied, if a local storage constraint has been satisfied and if the received data unit is redundant with a previously buffered data unit, comprises network control data, is associated with a device that has already been observed more frequently than other devices or originates from a low threat wireless node;

(vi) aggregate the received data unit with a previously buffered data unit if the bandwidth constraint is satisfied and if the received data unit is compatible with the previously buffered data unit; and

(vii) transmit a selected buffered data unit to the to the monitoring processor via the communication interface at a point in time after receipt based upon the bandwidth constraint and bandwidth usage.

19. A system of monitoring a wireless network, the system comprising:

(a) receiving means for receiving a plurality of data units from one or more wireless nodes;

(b) buffer means for deterministically accepting for buffering a received data unit of the plurality of data units from the receiving means if a bandwidth constraint is satisfied, aggregating the deterministically accepted data unit with a previously buffered data unit if the deterministically accepted data unit is compatible with the previously buffered data unit, discarding the deterministically accepted data unit if a storage constraint is satisfied and if the deterministically accepted data unit is redundant with a previously buffered data unit, comprises network control data, is associated with a device that has already been observed more frequently than other devices or originates from a low threat wireless node; and

(c) output means for immediately transmitting a received data unit to a monitoring processor if the bandwidth constraint is not satisfied and for transmitting a buffered data unit to the monitoring processor at a point in time after receipt based upon the bandwidth constraint and bandwidth usage;

wherein deterministically accepting comprises a sequential traversal of the one or more wireless nodes, a selection based upon amount of buffered data for each wireless node in the one or more wireless nodes, a selection based upon a threat level for each wireless node in the one or more wireless nodes or combinations thereof.