Methods and systems for network traffic security

• US 7,818,805 B2
• Filed: 09/25/2008
• Issued: 10/19/2010
• Est. Priority Date: 09/09/2004
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Baldonado, Omar C., Karam, Mansour J., Finn, Sean P., Lloyd, Michael A., Fraval, Pierre, McGuire, James G.
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Nobahar; Abdulhakim
• Application Number:
  US12/284,933
• Publication Number:
  US 20090031420A1
• Time in Patent Office: 754 Days
• Field of Search: 726 2- 7, 726 11- 14, 726 21- 25, 713/153, 713/154, 709223-225, 709238-240
• US Class Current: 726/23
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5019 Ensuring fulfilment of SLA
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/121 by minimising delays
• CPC Class Codes: H04L 45/124 using a combination of metrics
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/15 in relation to multipoint traffic arrangements for broadcast or multicast in data networks H04L12/18
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/283 in response to processing delays, e.g. caused by jitter or round trip time [RTT]
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 47/822 : Collecting or measuring resource availability data
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 63/0263 : Rule management
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection

Abstract

The present invention is directed to methods of and systems for adaptive networking that monitors a network resource of a network. The method monitors an application performance. The method categorizes a first subset of traffic of the network. The categories for the first subset include trusted, known to be bad, and suspect. The method determines an action for a second subset of traffic based on the category for the first subset of traffic. Some embodiments provide a system for adaptive networking that includes a first device and traffic that has a first subset and a second subset. The system also includes a first resource and a second resource for the transmission of the traffic. The first device receives the traffic and categorizes the traffic into the first and second subsets. The first device assigns the first subset to the first resource. Some embodiments provide a network device that includes an input for receiving incoming traffic, an output for sending outgoing traffic, a categorization module that categorizes incoming traffic, and a resource assignment module that assigns the categorized traffic for a particular resource. A traffic category for the device includes suspect traffic.

Claims

1. A method of routing data comprising:

a. receiving a data stream from a node, the data stream comprising a plurality of data packets;

b. classifying the plurality of data packets, wherein the classifications include;

i. trusted traffic, wherein trusted traffic includes data from a trusted source;

ii. bad traffic, wherein bad traffic includes data that is known to contain undesirable data; and

iii. suspect traffic, wherein suspect traffic includes data that is unknown or that is not from a trusted source; and

c. routing each of the plurality of data packets to a common destination via a path selected based upon the classification of the data packet, wherein trusted traffic is routed to the common destination via a first path, wherein the bad traffic is routed to the common destination via a second path, wherein the suspect traffic is routed to the common destination via a third path, and wherein the first and third paths are different.

2. The method of claim 1, wherein the first path comprises a first resource and wherein the trusted traffic is routed via the first path by using the first resource, wherein the second path comprises a second resource and wherein the bad traffic is routed via the second path by using the second resource, and wherein the third path comprises a third resource and wherein the suspect traffic is routed via the third path by using the third resource.

3. The method of claim 2, wherein a plurality of the first, second, and third resources are the same logical resource.

4. The method of claim 2, wherein a plurality of the first, second, and third resources are the same physical resource.

5. The method of claim 2, wherein the first, second, and third resources are different resources.

6. The method of claim 1, wherein the second path is different from the first and third paths.

7. The method of claim 1, wherein the second path is the same as one of the first and third paths.

8. The method of claim 1, further comprising providing an always on architecture, such that a packet is classified as suspect before the packet is proven to be trusted.

9. The method of claim 1, further comprising steering traffic away from an attack related performance problem.

10. The method of claim 9, wherein the performance problem includes one of application performance degradation, a brownout, and a blackout.