Hardware accelerated application-based pattern matching for real time classification and recording of network traffic

• US 8,666,985 B2
• Filed: 03/15/2012
• Issued: 03/04/2014
• Est. Priority Date: 03/16/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Solera Networks, Inc. (Gen Digital Inc.)
• Inventors: Wood, Matthew S., Levy, Joseph H., Marston, McKay
• Primary Examiner(s): Beausoliel, Jr., Robert
• Assistant Examiner(s): Khakhar, Nirav K
• Application Number:
  US13/421,757
• Publication Number:
  US 20120239652A1
• Time in Patent Office: 719 Days
• Field of Search: None
• US Class Current: 707/737
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

An indexing database utilizes a non-transitory storage medium. A pattern matching processing unit generates preclassification data for the network data packets utilizing pattern matching analysis. At least one processing unit implements a storage process that receives the network data packets, stores the network data packets in at least one of the slots, and transfers the network data packets to a packet capture repository when slots in a shared memory are full. A preclassification process requests from the pattern matching processing unit the preclassification data. An indexing process determines, based upon the preclassification data, whether to invoke or omit additional analysis of the network data packets, and performs at least one of aggregation, classification, or annotation of the network data packets in the shared memory to maintain one or more indices in the indexing database.

Claims

1. A system, comprising:

a shared memory that includes a plurality of slots to transiently store network data packets;

a packet capture repository utilizing a non-transitory storage medium;

an indexing database utilizing a non-transitory storage medium;

a pattern matching processing unit to generate preclassification data for the network data packets utilizing pattern matching analysis, wherein the pattern matching processing unit includes a graphical processing unit with multiple cores to analyze multiple network data packets in parallel; and

at least one processing unit that implements;

a storage process that receives the network data packets, stores the network data packets in at least one of the slots, and transfers the network data packets to the packet capture repository when the slots in the shared memory are full;

a preclassification process that request from the pattern matching processing unit the preclassification data; and

an indexing process to;

determine, based upon the preclassification data, whether to invoke or omit additional analysis of the network data packets, such that the indexing process resources are dedicated to further analyzing network data packets of greater concern, and

perform at least one of aggregation, classification, or annotation of the network data packets in the shared memory to maintain one or more indices in the indexing database.

2. The system of claim 1 wherein the preclassification process normalizes data within the network data packets.

3. The system of claim 1 wherein the pattern matching analysis is Aho-Corasick string matching.

4. The system of claim 1 wherein the pattern matching analysis is selected from identifying the application to which the network data packets relate, identifying the protocol utilized to transmit the network data packets, identifying file types of payload data in the network data packets, identifying source or destination addresses associated with the network data packets and identifying the lengths of network data packets.

5. The system of claim 1 wherein copyless direct memory access data transfers are used between the plurality of slots.

6. The system of claim 1 wherein the additional analysis determines the names and types of files being shared.

7. The system of claim 1 wherein the additional analysis includes identifying and indexing protocol-specific attributes.

8. The system of claim 1 wherein the additional analysis includes identifying and indexing web-based applications.

9. The system of claim 8 wherein identifying and indexing web-based applications includes identifying and indexing a particular HTTP session.