Network event capture and retention system

• US 8,676,960 B2
• Filed: 05/30/2006
• Issued: 03/18/2014
• Est. Priority Date: 12/03/2003
• Status: Active Grant

• Current Assignee: RSA Security LLC (Symphony Technology Group LLC)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Brady, Bernard E. Jr., Johnson, Mark, Stevens, Matthew, Volk, Scott David
• Primary Examiner(s): MACILWINEN, JOHN MOORE JAIN
• Application Number:
  US11/443,325
• Publication Number:
  US 20070011310A1
• Time in Patent Office: 2,849 Days
• Field of Search: 709223-225
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Methods and apparatus are provided to monitor and analyze activity occurring on a networked computer system. In some embodiments, a method is provided for capturing, in a data structure, at least a portion of a notification describing a network event provided by a node on a computer network, identifying a data element (e.g., an IP address of the node) within the notification, and updating an index and/or summary based on the data element. The data structure may be stored in a file system maintained on a site, and sites may exchange information related to the notification data stored on each. In some embodiments, a query which is issued to a site may be processed using data transferred from other sites, and/or may be split into one or more additional queries which may be transmitted for processing to other sites.

Claims

1. A method, comprising:

collecting and storing a plurality of transmission events comprised within a packet payload reported by one or more nodes of a network, into one or more data structures by,

ascertaining one or more characteristics of each of one or selected said plurality of transmission events, and

creating said one or more data structures based on each of said one or more characteristics,

wherein each of said one or more data structures comprises one or more observation records generated from one or more of said plurality of transmission events and stored based on said one or more characteristics;

extracting one or more data elements and at least one data feature comprising content of a message from each of said plurality of transmission events stored in said one or more data structures;

creating one or more indices based on said stored data element, for each or for selected said one or more data structures,

wherein at least one of said one or more indices comprises at least one indicator of a location of said one or more data elements; and

creating one or more summaries for said each or of said selected data structures of said one or more data structures,

wherein at least one of said one or more summaries comprises one or more data features of said one or more transmission events for determining the presences of at least one or more data features in any of said one or more transmission events or in selected said one or more transmission events.

2. The method of claim 1, wherein, a response to a received query of one or more of said plurality of transmission events is formed from one or more of said one or more summaries absent a use of said one or more indices.

3. The method of claim 1, wherein said one or more indices or said one or more summaries are created using or summarizing at least one of said one or more characteristics comprised in said one or more observation records.

4. The method of claim 1, wherein storing said one or more observation records indicates the presence of at least one of said one or more characteristics in said one or selected of said one or more data structures.

5. The method of claim 1, wherein said one or more transmission events of said plurality of the transmission events are collected during one or more predetermined periods of time.

6. The method of claim 1, wherein at least one of said one or more observation records, generated using said one or more transmission events of said plurality of the transmission events, comprises one of said one or more transmission events in a complete unabridged form.

7. The method of claim 1, wherein at least one of said one or more data features comprise a number of occurrences of a destination internet protocol address for at least one of said content of a message of said transmission events in at least one of said one or more data structures.

8. The method of claim 1, wherein said one or more data elements are stored within at least one of said one or more data structures.

9. The method of claim 1, wherein each of said one or more indices comprises one or more of:

a type of or an importance level for a transmission event of said plurality of the transmission events,

an internet protocol address of a node of said one or more nodes having reported said transmission event, and

an internet protocol address of a node of said one or more nodes indicating a destination of said transmission event.

10. The method of claim 1, wherein said one or more data elements comprise partial or complete data comprised of said content of a message in at least one of the one or more transmission events.

11. The method of claim 1, wherein all or selected transmission events of said plurality of the transmission events are notifications provided by all or selected nodes of said one or more nodes of said network.

12. The method of claim 1, further comprising one or two of:

performing compression of said at least one data structure of said one or more data structures,

and creating a digital signature of said at least one data structure of said one or more data structures.

13. An apparatus, comprising:

a first controller processor, configured to collect and store a plurality of transmission events comprised within a packet payload reported by one or more nodes of a network, into one or more data structures, said first controller processor

ascertaining one or more characteristics of each of one or selected said plurality of transmission events, and

creating said one or more data structures based on each of said one or more characteristics,

wherein each of said one or more data structures comprises one or more observation records generated from one or more of said plurality of transmission events and stored based on said one or more characteristics;

a second controller processor, configured to extract one or more data elements and at least one data feature comprising content of a message from each of said plurality of transmission events stored in said one or more data structures;

a third controller processor, configured to create one or more indices based on said stored data element, for each or for selected said one or more data structures,

wherein at least one of said one or more indices comprises at least one indicator of a location of said one or more data elements, and

further configured to create one or more summaries for said each of the one or selected of said one or more data structures,

wherein at least one of said one or more summaries comprises one or more data features of said one or more transmission events for determining the presences of at least one or more data features in any of said one or selected of said one or more transmission events; and

a memory, configured to store said one or more indices and said one or more summaries.

14. The apparatus of claim 13, wherein said memory is further configured to store said one or more stored data structures.

15. The apparatus of claim 13, wherein, a response to a received query about one or more of said plurality of transmission events is formed absent a use of said one or more indices.

16. The apparatus of claim 13, wherein said one or more indices or said one or more summaries are created using or summarizing at least one of said one or more characteristics comprised in said one or more observation records.

17. The apparatus of claim 13, wherein storing said one or more observation records indicates the presence of at least one of said one or more characteristics in said one or selected of said one or more data structures.

18. The apparatus of claim 13, wherein said one or more transmission events of said plurality of the transmission events are collected during one or more predetermined periods of time.

19. The apparatus of claim 13, wherein at least one of said one or more observation records, created using one or more transmission events of said plurality of the transmission events, comprises one of said one or more transmission events in a complete-unabridged form.

20. A non-transitory computer-usable medium, comprising computer readable instructions stored thereon for execution by a processor to perform a method comprising:

collecting and storing a plurality of transmission events comprised within a packet payload reported by one or more nodes of a network, into one or more data structures by,

ascertaining one or more characteristics of each of one or selected said plurality of transmission events, and

creating said one or more data structures based on each of said one or more characteristics,

wherein each of said one or more data structures comprises one or more observation records generated from one or more of said plurality of transmission events and stored based on said one or more characteristics;

extracting one or more data elements and at least one data feature comprising content of a message from each of said plurality of transmission events stored in said one or more data structures;

creating one or more indices based on said stored data element, for said each of the one or selected of said one or more data structures,

wherein at least one of said one or more indices comprises at least one indicator of a location of said one or more data elements; and

creating one or more summaries for said each of the one or selected data structures of said one or more data structures,

wherein at least one of said one or more summaries comprises one or more data features of said one or more transmission events for determining the presences of at least one or more data features in any of said one or more transmission events or in selected said one or more transmission events.