Server resource management, analysis, and intrusion negotiation

• US 8,763,119 B2
• Filed: 03/08/2013
• Issued: 06/24/2014
• Est. Priority Date: 11/08/2002
• Status: Expired due to Term

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Home Run Patents LLC
• Inventors: Sample, Char
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US13/790,198
• Publication Number:
  US 20130191533A1
• Time in Patent Office: 473 Days
• Field of Search: 726/4, 726/22, 709/224, 709/229
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A console host and intrusion negation system (CHAINS) includes a host component and a console component. The host component monitors resources at a server. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Claims

1. A method comprising:

monitoring, by one or more processors, at least one resource associated with a network server,

the at least one resource including a communication interface of the network server,

the monitoring the at least one resource including;

determining a number of open network connections associated with the communication interface of the network server;

comparing, by one or more processors, an activity level of the at least one resource to a threshold activity level; and

reducing, by one or more processors, usage of one resource of the at least one resource when the activity level associated with the one resource increases above the threshold activity level,

the reducing the usage of the one resource including;

reducing the number of open network connections by closing open network connections based on a priority of the open network connections, wherein the closing of the open network connections includes;

randomly selecting an open network connection, the selected open network connection being an active network connection; and

closing the selected open network connection.

2. The method of claim 1, where the at least one resource includes a random access memory associated with the network server, and where monitoring the at least one resource includes determining usage of the random access memory associated with the network server.

3. The method of claim 2, where reducing usage of the one resource includes reducing the usage of the random access memory by shutting down inactive processes.

4. The method of claim 1, where the at least one resource includes a processor of the network server, and

where monitoring the at least one resource includes determining usage of the processor of the network server.

5. The method of claim 4, where reducing usage of the one resource includes reducing the usage of the processor by shutting down processes with lower priorities than priorities of other processes.

6. The method of claim 1, where the at least one resource includes a hard disk drive associated with the network server, and

where monitoring the at least one resource includes determining usage of the hard disk drive associated with the network server.

7. The method of claim 6, where reducing usage of the one of the at least one resource includes reducing the usage of the hard disk drive by compressing files.

8. The method of claim 1, further comprising:

alerting a user when the activity level associated with the one resource increases above the threshold activity level.

9. The method of claim 8, where alerting the user includes transmitting an alert to a remote computer.

10. The method of claim 1, where the threshold activity level is received from a remote computer.

11. The method of claim 1, where reducing usage of the one of the at least one resource further includes refusing to open new network connections.

12. The method of claim 1, further comprising before the comparing of the activity level, setting the threshold activity level based on a historical activity level.

13. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

monitor at least one resource associated with a network server,

the at least one resource including;

a communication interface of the network server,

the one or more instructions that cause the one or more processors to monitor the at least one resource including one or more instructions that cause one or more processors to determine a number of open network connections associated with the communication interface of the network server;

compare an activity level of the at least one resource to a threshold activity level; and

reduce usage of one resource of the at least one resource when the activity level associated with the one resource increases above the threshold activity level,

the one or more instructions that cause the one or more processors to reduce the usage of the one resource including;

one or more instructions that cause one or more processors to reduce the number of open network connections by closing open network connections based on a priority of the open network connections, wherein the closing of the open network connections includes;

randomly select an open network connection, the selected open network connection being an active network connection; and

close the selected open network connection.

14. The non-transitory computer-readable medium of claim 13, where the at least one resource includes a random access memory associated with the network server,

where the one or more instructions that cause the one or more processors to monitor the at least one resource include one or more instructions that cause the one or more processors to determine usage of the random access memory associated with the network server, and

where the one or more instructions that cause the one or more processors to reduce usage of the one resource include one or more instructions that cause the one or more processors to reduce the usage of the random access memory by shutting down inactive processes.

15. The non-transitory computer-readable medium of claim 13, where the at least one resource includes a processor of the network server,

where the one or more instructions that cause the one or more processors to monitor the at least one resource include one or more instructions that cause the one or more processors to determine usage of the processor of the network server, and

where the one or more instructions that cause the one or more processors to reduce usage of the one resource include one or more instructions that cause the one or more processors to reduce the usage of the processor by shutting down processes with lower priorities than priorities of other processes.

16. The non-transitory computer-readable medium of claim 13, where the at least one resource includes a hard disk drive associated with the network server,

where the one or more instructions that cause the one or more processors to monitor the at least one resource include one or more instructions that cause the one or more processors to determine usage of the hard disk drive associated with the network server, and

where the one or more instructions that cause the one or more processors to reduce usage of the one resource include one or more instructions that cause the one or more processors to reduce the usage of the hard disk drive by compressing files.

17. The non-transitory computer-readable medium of claim 13, where the instructions further include one or more instructions that cause the one or more processors to alert a user when the activity level associated with the one resource increases above the threshold activity level.

18. A system comprising:

one or more processors to;

monitor at least one resource associated with a network server,

the at least one resource including a communication interface of the network server,

when monitoring the at least one resource, the one or more processors being to;

determine a number of open network connections using the communication interface of the network server;

compare an activity level of the at least one resource to a threshold activity level; and

reduce usage of one resource of the at least one resource when the activity level associated with the one resource increases above the threshold activity level,

when reducing the usage of the one resource, the one or more processors being to;

reduce the number of open network connections by closing open network connections based on a priority of the open network connections, wherein the closing of the open network connections includes;

randomly select an open network connection, the selected open network connection being an active network connection; and

close the selected open network connection.

19. The system of claim 18, where the at least one resource includes a random access memory associated with the network server,

where, when monitoring the at least one resource, the one or more processors are to determine usage of the random access memory associated with the network server, and

where, when reducing usage of the one resource, the one or more processors are to reduce the usage of the random access memory by shutting down inactive processes.

20. The system of claim 18, where the at least one resource includes a processor of the network server,

where, when monitoring the at least one resource, the one or more processors are to determine usage of the processor of the network server, and

where, when reducing usage of the one resource, the one or more processors are to reduce the usage of the processor by shutting down processes with lower priorities than priorities of other processes.

21. The system of claim 18, where the at least one resource includes a hard disk drive associated with the network server,

where, when monitoring the at least one resource, the one or more processors are to determine usage of the hard disk drive associated with the network server, and

where, when reducing usage of the one resource, the one or more processors are to reduce the usage of the hard disk drive by compressing files.