Automatic provisioning of new users of interest for capture on a communication network

• US 8,938,534 B2
• Filed: 12/22/2011
• Issued: 01/20/2015
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: SS8 Networks Incorporated
• Original Assignee: SS8 Networks Incorporated
• Inventors: Le, Robert, Bean, Timothy, Mctiernan, Kevin
• Primary Examiner(s): VU, VIET D
• Application Number:
  US13/334,785
• Publication Number:
  US 20120259975A1
• Time in Patent Office: 1,125 Days
• Field of Search: 709/204, 709/205, 709/206, 709/223, 709/224, 709/225
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. A metadata portion of at least one of the data streams is analyzed on the network and evaluated using a metadata processing engine to identify a relationship between at least two of the plurality of data streams, e.g., a relationship between multiple users of a network, regardless of whether the users are currently of interest or if they are not of interest. An interface manager can receive an information of a new user of interest, evaluate the new user of interest for redundancy against existing known users of interest of the NMS; then communicate the information of the new user of interest to at least one access device to collect data streams associated with the new user of interest.

Claims

1. A network monitoring system comprising:

an access device operative to;

intercept data in transit over a computer network, and

parse a data stream of the data in transit over the computer network based on an interception request made by an analyst to probe the computer network for a communication of a known user of interest; and

a metadata processing engine coupled to the access device, wherein the metadata processing engine determines a new user of interest using metadata from a user not currently of interest in conjunction with metadata from the communication of the known user of interest, and wherein the metadata processing engine is operative to;

accept the communication from the access device,

evaluate the communication intercepted from the computer network for a relationship between the metadata of the communication of the known user of interest and the user not currently of interest,

convert the user not currently of interest to a new user of interest based on the evaluation of the data retrieved from the computer network,

automatically provision the new user of interest through enabling automatic generation of a second interception criteria to probe the computer network for a second communication of the new user of interest,

communicate an identification (ID) for the new user of interest to the access device to enable the access device retrieve a second set of data that is in transit over the computer network based on the automatically generated second interception criteria to probe the computer network for the second communication of the new user of interest, and

monitor the computer network for the second set of data related to the new user of interest.

2. The network monitoring system of claim 1, wherein the metadata processing engine is operative to retrieve a content data of all data streams in the computer network for analysis and a metadata portion of all the data streams in the computer network for analysis.

3. The network monitoring system of claim 2, wherein the content data of all the data streams in the computer network and the metadata portion of all the data streams in the computer network are evaluated for metrics.

4. The network monitoring system of claim 1, wherein evaluation of a set of metadata from a set of communications of the user not currently of interest occurs in parallel to evaluation of the data from the known user of interest.

5. The network monitoring system of claim 1, wherein the metadata processing engine is further operative to:

receive a metadata value of the known user of interest, and

seek a metadata value associated with the user not currently of interest having a relationship to the metadata value of the known user of interest.

6. The network monitoring system of claim 1, wherein the metadata processing engine is further operative to:

strip and discard a content portion of the parsed data stream.

7. The network monitoring system of claim 1, wherein the metadata processing engine is operative to transmit the metadata of the communication from the user not currently of interest to a graphical user interface (GUI) of a terminal of a law enforcement agency for analysis.

8. The network monitoring system of claim 7, wherein the metadata processing engine is operative to identify the user not currently of interest as the new user of interest to the law enforcement agency based on a relationship of the metadata associated with the user not currently of interest to any data of the known user of interest.

9. A method of monitoring data, the method comprising:

retrieving data in transit over a computer network through an access device based on an interception request made by an analyst to probe the computer network for a communication of a known user of interest, the communication comprising content data and metadata;

appending, through the access device, a detail about the communication to a header of a data packet of the communication, the detail about the communication comprising at least one of a known user ID of the known user of interest and an identification of the analyst authorized to analyze the content data of the communication;

determining that the communication of the known user of interest includes metadata identifying a user not currently of interest;

converting the user not currently of interest into a new user of interest based on the determination that the communication of the known user of interest includes the metadata identifying the user not currently of interest;

communicating an ID for the new user of interest to the access device to enable the access device retrieve a new set of data that is in transit over the computer network; and

monitoring the computer network for the new set of data related to the new user of interest.

10. The method of claim 9, comprising retrieving a content data of all data streams in the computer network for analysis and a metadata portion of all the data streams in the computer network for analysis.

11. The method of claim 10, comprising evaluating the content data of all the data streams in the computer network and the metadata portion of all the data streams in the computer network for metrics.

12. The method of claim 9, comprising receiving and evaluating the metadata associated with the user not currently of interest automatically without input from the analyst.

13. The method of claim 9, further comprising:

stripping and discarding a content portion of the retrieved data.

14. The method of claim 9, further comprising:

receiving a metadata value of the known user of interest; and

seeking a metadata value associated with the user not currently of interest having a relationship to the metadata value of the known user of interest.

15. The method of claim 14, further comprising:

identifying the user not currently of interest as the new user of interest based on a relationship of the metadata of the user not currently of interest to any data of the known user of interest.

16. A network monitoring system comprising:

an access device operative to;

intercept data in transit over a computer network,

parse a data stream of the data in transit over the computer network based on an interception request made by an analyst to probe the computer network for a communication of a known user of interest, the communication comprising content data and metadata, and

append, to a header of a data packet of the communication, a detail about the communication, the detail about the communication comprising at least one of a known user ID of the known user of interest and an identification of the analyst authorized to analyze the content data of the communication; and

a metadata processing engine coupled to the access device, wherein the metadata processing engine determines a new user of interest using metadata from a user not currently of interest in conjunction with metadata from the communication of the known user of interest, and wherein the metadata processing engine is operative to;

accept the communication from the access device,

evaluate the communication intercepted from the computer network for a relationship between the metadata of the communication of the known user of interest and the user not currently of interest,

convert the user not currently of interest to a new user of interest based on the evaluation of the data retrieved from the computer network,

communicate an ID for the new user of interest to the access device, and

monitor the computer network for a new set of data related to the new user of interest.

17. The network monitoring system of claim 16, wherein the metadata processing engine is operative to retrieve a content data of all data streams in the computer network for analysis and a metadata portion of all the data streams in the computer network for analysis.

18. The network monitoring system of claim 17, wherein the content data of all the data streams in the computer network and the metadata portion of all the data streams in the computer network are evaluated for metrics.

19. The network monitoring system of claim 16, wherein the conversion of the user not currently of interest to the new user of interest on the computer network is performed automatically without an approval from the analyst.

20. The network monitoring system of claim 16, wherein the conversion of the user not currently of interest to the new user of interest is performed by algorithmic evaluation of the data from the computer network.

21. The network monitoring system of claim 16, further comprising:

a network buffering system comprising a set of one or more storages to buffer the data in transit over the computer network such that a content portion of a data of the user not currently of interest is retained while the data of the user currently of interest is analyzed to determine whether the user not currently of interest should be the new user of interest.

22. The network monitoring system of claim 21, wherein the network buffering system is further operative to:

halt within a first storage of the one or more storages an overwriting of an existing data upon sensing a critical security event that comprises at least one of sensing a key term and a key communication traffic from any one of the known user of interest, the user not currently of interest, and the new user of interest, and

seamlessly transition a recording of a set of current communications in transit over the computer network to a second storage of the one or more storages.

23. The network monitored system of claim 16, wherein the metadata processing engine is further operative to:

notify the analyst that the new user of interest has been added to the computer network, and

request an approval from the analyst for the changing of status to the new user of interest, and

wherein the device intercepts the data in transit over the computer network with at least one of a passive probe tapped into a junction on a line of the computer network and an active port of a network router.

24. The network monitoring system of claim 16, wherein the metadata processing engine is further operative to:

withdraw the new user of interest from being monitored on the computer network if the analyst disapproves of the conversion of the user not currently of interest to the new user of interest, and

change a status of the ID of the new user of interest to that of the user not currently of interest in accordance with the withdrawal.

25. A method of provisioning a user to be monitored in a computer network, the method comprising:

retrieving data in transit over the computer network through an access device based on an interception request made by an analyst to probe the computer network for a communication of a known user of interest;

determining that the communication of the known user of interest includes metadata identifying a user not currently of interest;

converting the user not currently of interest into a new user of interest based on the determination that the communication of the known user of interest includes the metadata identifying the user not currently of interest;

automatically provisioning the new user of interest by automatically generating a second interception criteria to probe the computer network for a second communication of the new user of interest;

communicating an ID for the new user of interest to the access device to enable the access device retrieve a second set of data that is in transit over the computer network based upon the automatically generated second interception criteria to probe the computer network for the second communication of the new user of interest; and

monitoring the computer network for the second set of data related to the new user of interest.

26. The method of provisioning of claim 25, wherein the data retrieved from the computer network to create the new user of interest is content data and metadata that is evaluated at a metadata processing engine coupled to the access device.

27. The method of provisioning of claim 25, further comprising:

retrieving the second set of data in transit over the computer network from the access device based upon the second interception criteria to probe the computer network for the second communication of the new user of interest;

determining that the second communication of the new user of interest includes a metadata identifying a different user not currently of interest; and

converting the different user not currently of interest into a second new user of interest based on the determination that the second communication of the new user of interest includes the metadata identifying the different user not currently of interest.

28. The method of provisioning of claim 27, further comprising:

automatically provisioning the second new user of interest to generate a third interception criteria to probe the computer network for a third communication of the second new user of interest.

29. The method of provisioning of claim 25, comprising performing algorithmic evaluation of the data from the computer network to create the new user of interest on the computer network.

30. The method of provisioning of claim 29, wherein the performing of the algorithmic evaluation further comprises:

constructing a link between the user not currently of interest and the known user of interest based on metadata associated with the user not currently of interest and based on any data of the known user of interest.

31. The method of provisioning of claim 28, further comprising:

communicating a second ID for the second new user of interest to the access device to enable the access device retrieve a third set of data that is in transit over the computer network based upon the automatically generated third interception criteria to probe the computer network for the third communication of the second new user of interest.

32. The method of provisioning of claim 25, further comprising:

notifying an analyst that the new user of interest has been added to the computer network; and

requesting an approval from the analyst for the addition.

33. The method of provisioning of claim 25, further comprising:

withdrawing the new user of interest from being monitored on the computer network if the analyst disapproves of conversion of the user not currently of interest to the new user of interest; and

changing a status of the identification ID of the new user of interest to that of the user not currently of interest in accordance with the withdrawal.