On-box active reconnaissance

• US 7,934,257 B1
• Filed: 01/07/2005
• Issued: 04/26/2011
• Est. Priority Date: 01/07/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kienzle, Darrell, Swinton, Paul
• Primary Examiner(s): Dinh; Minh
• Assistant Examiner(s): Perungavoor; Venkat
• Application Number:
  US11/030,139
• Time in Patent Office: 2,300 Days
• Field of Search: 726 22- 25, 726 11- 12, 726/16, 713153-155
• US Class Current: 726/23
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

A method of monitoring events in a network associated with a node. An agent collects event information associated with the monitored activities, based on a set of collection rules. A determination is made whether a portion of the collected event information complies or potentially complies with one of a set of patterns. An agent selects event information from the collection based on the determination, and makes the selected event information available to a manager associated with the node and other nodes in the network. The agent manager receives event information from a plurality of agents. A triggering event is identified, as a function of the set of patterns, based on the event information. The agent manager sends at least one request to a selected set of the agents for additional event information when a triggering event is identified.

Claims

1. A computer-implemented method of monitoring events in a network, comprising:

monitoring activities received over the network associated with a node located remotely over the network;

collecting event information associated with the monitored activities and based on a set of collection rules, the collection rules specifying a set of patterns associated with a triggering event and a timeout window for collection of the event information, the event information being stored in a database;

determining whether a portion of the collected event information stored in the database complies or potentially complies with one of the set of patterns and is considered a supporting event of the triggering event;

selecting event information as supporting events from the collected event information stored in the database based on the determination, and if none of the collected event information is found to be a supporting event, establishing a temporary rule to forward any future supporting events that comply with or potentially comply with one of the set of patterns; and

sending the selected event information and future supporting events to a manager associated with the node and other nodes over the network;

wherein the temporary rule is automatically removed when the timeout window has elapsed.

2. The method of claim 1, wherein the selecting step includes the substep of:

examining rotating backlogs for supporting events.

3. A computer system for monitoring events in a network, the system comprising:

an event monitor configured to monitor activities associated with a node;

an event collector configured to collect event information associated with the monitored activities and based on a set of collection rules, the collection rules specifying a set of patterns associated with a triggering event and a timeout window for collection of the event information;

an event selector configured to determine whether a portion of the collected event information complies or potentially complies with one of the set of patterns and is considered a supporting event of the triggering event and select event information as supporting events from the collection based on the determination, and if none of the collected event information is found to be a supporting event, establish a temporary rule to forward any future supporting events that comply with or potentially comply with one of the set of patterns; and

an event transmitter configured to make the selected event information and future supporting events available to a manager associated with the node and other nodes in the network;

wherein the temporary rule is automatically removed when the timeout window has elapsed.

4. The system of claim 3, wherein the event transmitter sends requested event information in response to a request from a manager.

5. The system of claim 3, wherein the event selector examines rotating backlogs for supporting events.

6. A computer system for monitoring events in a network, the system comprising:

a set of agents, each of which;

monitors activities associated with a node,

determines whether a portion of collected event information complies or potentially complies with one of a set of stored patterns and is considered a supporting event of a triggering event, and

selects event information as supporting events from the collection based on the determination, and if none of the collected event information is found to be a supporting event, establishes a temporary rule to forward any future supporting events that comply with or potentially comply with one of the set of patterns; and

a manager that;

receives event information from each of the set of agents,

identifies a triggering event based on the received event information, wherein the triggering event is an event with the least likelihood of occurrence from among the events in a network, and

sends at least one request for supporting event information of the triggering event to a selected agent when a triggering event is identified.

7. A non-transitory computer-readable medium including instructions for performing a method for monitoring events in a network, the method comprising:

monitoring activities associated with a node;

collecting event information associated with the monitored activities and based on a set of collection rules, the collection rules specifying a set of patterns associated with a triggering event and a timeout window for collection of the event information;

determining whether a portion of the collected event information complies or potentially complies with one of the set of patterns and is considered a supporting event of the triggering event;

selecting event information as supporting events from the collected event information based on the determination, and if none of the collected event information is found to be a supporting event, establishing a temporary rule to forward any future supporting events that comply with or potentially comply with one of the set of patterns; and

making the selected event information and future supporting events available to a manager associated with the node and other nodes in the network;

wherein the temporary rule is automatically removed when the timeout window has elapsed.

8. The computer-readable medium of claim 7, wherein the method further includes:

sending requested event information in response to a request from a manager.

9. The computer-readable medium of claim 7, wherein the selecting step includes the substep of:

examining rotating backlogs for supporting events.