Server resource management, analysis, and intrusion negation

• US 8,397,296 B2
• Filed: 02/06/2008
• Issued: 03/12/2013
• Est. Priority Date: 11/08/2002
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Sample, Char
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US12/027,210
• Publication Number:
  US 20080133749A1
• Time in Patent Office: 1,861 Days
• Field of Search: 726/23, 726/24, 726/25, 726/1, 718/105, 709/226, 716/164, 713/165, 713/166, 713/167
• US Class Current: 726/23
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A console host and intrusion negation system (CHAINS) includes a host component and a console component. The host component monitors resources at a server. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Claims

1. A method, performed by a first server, the method comprising:

providing, by the first server, an interface having interactive elements, the interactive elements allowing indication of a threshold associated with an activity level of one of a number of resources associated with at least one of a plurality of network servers, the number of resources including at least one of a network connection, a processor, a random access memory, or a hard disk drive;

receiving, by the first server, an indication to set a threshold associated with a particular resource of the number of resources and a particular network server of the plurality of network servers, the particular network server being a different server than the first server;

transmitting, from the first server, a message to the particular network server, the message containing the threshold;

receiving, by the first server, an alert from the particular network server, the alert indicating that the activity level of the resource of the number of resources associated with the particular network server has exceeded the threshold;

providing, by the first server, the alert to a user; and

providing, by the first server, instruction to the particular network server to use the particular resource associated with another network server of the plurality of network servers.

2. The method of claim 1, where providing the alert includes displaying the alert on a display device of the first server.

3. The method of claim 2, further comprising:

displaying the threshold on the display device.

4. The method of claim 1, further comprising:

logging the alert.

5. The method of claim 1, where the alert is a first alert, where the particular network server is a first network server of the plurality of network servers, where the threshold is a first threshold, the method further comprising:

receiving a second alert from a second network server of the plurality of network servers,

the second alert indicating that an activity level of the particular resource associated with the second network server has exceeded a second threshold;

correlating the first alert and the second alert based on similarity of resource and timing of the first alert and second alert; and

providing an indication of a denial of service attack based on the correlation.

6. The method of claim 1, where providing the alert to the user includes sending an e-mail to the user.

7. The method of claim 1, where providing the alert to the user includes sending a pager notice to the user.

8. The method of claim 1, where the particular network server monitors the activity level of the particular resource.

9. The method of claim 1, where the interface includes a plurality of interactive elements,

where a first interactive element, of the plurality of interactive elements, allows adjustment of the threshold associated with the activity level of the particular resource associated with the particular network server, and

where a second interactive element, of the plurality of interactive elements, allows adjustment of a different threshold associated with an activity level of a different resource associated with the particular network server.

10. The method of claim 9, where the first and second interactive elements are provided simultaneously on a display device.

11. The method of claim 9, where the interactive elements include at least one graphical menu.

12. A non-transitory computer readable medium storing instructions executable by a processor of a first server, the instructions comprising:

a set of instructions that, when executed by the processor, cause the processor to provide an interface having interactive elements, the interactive elements allowing indication of a threshold associated with an activity level of one of a number of resources associated with at least one of a plurality of network servers, the number of resources including at least one of a network connection, a processor, a random access memory, or a hard disk drive;

a set of instructions that, when executed by the processor, cause the processor to receive, an indication to set a threshold associated with a particular resource of the number of resources and a particular network server of the plurality of network servers, the particular network server being a different server than the first server;

a set of instructions that, when executed by the processor, cause the processor to transmit a message to the particular network server, the message including the threshold, the particular network server monitoring an activity level of the particular resource;

a set of instructions that, when executed by the processor, cause the processor to receive, an alert from the particular network server, the alert indicating that the activity level of the particular resource of the number of resources associated with the particular network server has exceeded the threshold;

a set of instructions that, when executed by the processor, cause the processor to provide the alert to a user; and

a set of instructions that, when executed by the processor, cause the processor to provide instruction to the particular network server to use the particular resource associated with another network server of the plurality of network servers.

13. The computer readable medium of claim 12, where the set of instructions that cause the processor to provide the alert to the user includes a set of instructions that cause the processor to send an e-mail to the user.

14. The computer readable medium of claim 12, where the set of instructions that cause the processor to provide the alert to the user includes a set of instructions that cause the processor to send a pager notice to the user.

15. A first server, comprising:

one or more processors to;

provide an interface having interactive elements, the interactive elements allowing indication of a threshold associated with an activity level of one of a number of resources associated with at least one of a plurality of network servers, the number of resources including at least one of a network connection, a processor, a random access memory, or a hard disk drive;

receive an indication to set a threshold associated with a particular resource of the number of resources and a particular network server of the plurality of network servers, the particular network server being a different server than the first server;

transmit a message to the particular network server, the message containing the threshold;

receive an alert from the particular network server, the alert indicating that the activity level of the resource of the number of resources associated with the particular network server has exceeded the threshold;

provide the alert to a user; and

provide instruction to the particular network server to use the particular resource associated with another network server of the plurality of network servers.