Prioritizing network traffic

• US 8,606,910 B2
• Filed: 12/15/2011
• Issued: 12/10/2013
• Est. Priority Date: 04/04/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Krasser, Sven, Schneck, Phyllis Adele, Torrez, Jonathan
• Primary Examiner(s): SALL, EL HADJI MALICK
• Application Number:
  US13/326,896
• Publication Number:
  US 20120084441A1
• Time in Patent Office: 726 Days
• Field of Search: 709/203, 709/206, 709/224, 709/217, 709/229
• US Class Current: 709/224
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 based on throughput or bandwidth
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements

Abstract

Methods, systems and apparatus, including computer programs encoded on a computer storage medium, for receiving, at a global server system, from each of a plurality of local network devices, network data specifying network communication activity at the local network device, wherein the plurality of local network devices collectively provide backbone communications facilities for multiple networks; aggregating, at the global server system, the network data from each of the local network devices; analyzing, at the global server system, the aggregated network data to identify network activities; generating, at the global server system, update data based on the analysis of the aggregated network data, the update data including instructions for the local network devices for processing network communications to or from the local network devices; and transmitting from the global server system the update data to the local network devices.

Claims

1. A computer-implemented method, comprising:

receiving, at a global server system, from each of a plurality of local network devices, network data specifying network communication activity at the local network device, wherein the plurality of local network devices collectively provide backbone communications facilities for multiple networks;

aggregating, at the global server system, the network data from each of the local network devices;

analyzing, at the global server system, the aggregated network data to identify network activities;

generating, at the global server system, update data based on the analysis of the aggregated network data, the update data including instructions for the local network devices for processing network communications to or from the local network devices, wherein the instructions specify a prioritization schema for network communications based at least in part on reputations associated with network devices originating the network communications or associated with network devices to which the network communications are destined, the instructions operable to cause one or more local network devices to drop or delay particular network communications based at least in part on the prioritization schema; and

transmitting from the global server system the update data to the local network devices, the transmitting of the update data being one of a response to queries received from the local network devices or a push from the global server system to the local network devices.

2. The method of claim 1, wherein the instructions cause a local network device to prioritize a transmission of a network communication prior to transmitting the network communication to a next local network device in a communication path of the network communication.

3. The method of claim 1, wherein:

a network communication has a communication path defining a route from a local network device originating the network communication through one or more intermediate local network device hops to a local network device to which the network communication is destined; and

the instructions cause a local network device in the communication path to change or remove at least one of the intermediate local network device hops in the communication path.

4. The method of claim 1, wherein the network communication activity for a local network device specifies network communication traffic patterns or malicious activity at the local network device.

5. The method of claim 1, wherein the plurality of local network devices comprise local network devices operating on multiple, different service provider networks.

6. The method of claim 1, wherein network data are generated by the local network devices in real time with respect to network communication activity occurring at the local network devices.

7. The method of claim 1, wherein aggregating the network data, analyzing the aggregated network data, generating the update data and transmitting the update data are performed in real time.

8. The method of claim 1, wherein the plurality of local network devices comprises routers and gateways.

9. The method of claim 1, wherein transmitting from the global server system the update data to the local network devices comprises:

determining a frequency with which entities originate or receive network communications based on the network data; and

transmitting update data to local network devices processing network communications from entities originating or receiving network communications at a first frequency more frequently than to local network devices processing network communications from entities originating or receiving network communications at a second frequency lower than the first frequency.

10. The method of claim 1, further comprising:

iteratively receiving, at the global server system, additional network data from the plurality of local network devices specifying additional network communication activity at the local network devices; and

after each iteration of the received additional network data;

aggregating, at the global server system, the additional network data from each of the local network devices;

analyzing, at the global server system, the aggregated additional network data to identify network activities;

generating, at the global server system, additional update data based on the analysis of the aggregated additional network data, the additional update data including further instructions for the local network devices for processing network communications to or from the local network devices; and

transmitting from the global server system the additional update data to the local network devices, the transmitting of the additional update data being one of a response to queries received from the local network devices or a push from the global server system to the local network devices.

11. A system, comprising:

a global server system operable to;

receive from each of a plurality of local network devices, network data specifying network communication activity at the local network device, wherein the plurality of local network devices collectively provide backbone communications facilities for multiple networks;

aggregate the network data from each of the local network devices;

analyze the aggregated network data to identify network activities;

generate update data based on the analysis of the aggregated network data, the update data including instructions for the local network devices for processing network communications to or from the local network devices, wherein the instructions specify a prioritization schema for network communications based at least in part on reputations associated with network devices originating the network communications or associated with network devices to which the network communications are destined, the instructions operable to cause one or more local network devices to drop or delay particular network communications based at least in part on the prioritization schema; and

transmit the update data to the local network devices, the transmitting of the update data being one of a response to queries received from the local network devices or a push from the global server system to the local network devices.

12. The system of claim 11, wherein each of the plurality of network devices is operable to transmit the network data to the global server system.

13. The system of claim 11, wherein the instructions cause a local network device to prioritize a transmission of a network communication prior to transmitting the network communication to a next local network device in a communication path of the network communication.

14. The system of claim 11, wherein the global server system is further operable to:

iteratively receive additional network data from the plurality of local network devices specifying additional network communication activity at the local network devices; and

after each iteration of the received additional network data;

aggregate the additional network data from each of the local network devices;

analyze the aggregated additional network data to identify network activities;

generate additional update data based on the analysis of the aggregated additional network data, the additional update data including further instructions for the local network devices for processing network communications to or from the local network devices; and

transmit the additional update data to the local network devices, the transmitting of the additional update data being one of a response to queries received from the local network devices or a push from the global server system to the local network devices.

15. The system of claim 11, further comprising:

the plurality of local network devices, wherein each of the plurality of local network devices is operable to transmit network data to the global server system.

16. The system of claim 11, wherein:

a network communication has a communication path defining a route from a local network device originating the network communication through one or more intermediate local network device hops to a local network device to which the network communication is destined; and

the instructions cause a local network device in the communication path to change or remove at least one of the intermediate local network device hops in the communication path.

17. A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations, comprising:

receiving, at a global server system, from each of a plurality of local network devices, network data specifying network communication activity at the local network device, wherein the plurality of local network devices collectively provide backbone communications facilities for multiple networks;

aggregating, at the global server system, the network data from each of the local network devices;

analyzing, at the global server system, the aggregated network data to identify network activities;

generating, at the global server system, update data based on the analysis of the aggregated network data, the update data including instructions for the local network devices for processing network communications to or from the local network devices, wherein the instructions specify a prioritization schema for network communications based at least in part on reputations associated with network devices originating the network communications or associated with network devices to which the network communications are destined, the instructions operable to cause one or more local network devices to drop or delay particular network communications based at least in part on the prioritization schema; and

transmitting from the global server system the update data to the local network devices, the transmitting of the update data being one of a response to queries received from the local network devices or a push from the global server system to the local network devices.