Method and system for monitoring flows in network traffic

• US 9,055,113 B2
• Filed: 08/20/2010
• Issued: 06/09/2015
• Est. Priority Date: 08/20/2010
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Makhija, Dinesh
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US12/860,127
• Publication Number:
  US 20120047248A1
• Time in Patent Office: 1,754 Days
• Field of Search: 709223-225, 709/231, 705/14.25, 715/745
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method and system for correlating web content with content providers to determine the origin of the content such that it is not necessary to look inside the information exchange. The method and system maintains sequences of reference points, which are ordered lists of content providers accessed by subscribers over time, and correlates the internet content applications, such as video, found in network traffic to the sequence of reference points accessed by subscribers to determine the origins of the content even when the content being delivered by third-party content delivery networks.

Claims

1. A method for correlating network traffic, the method comprising:

determining one or more content providers accessed by a subscriber;

maintaining a sequence of reference points for the subscriber, the sequence of reference points being ordered lists of the one or more content providers accessed by the subscriber;

monitoring network traffic for characteristics of an internet content application to be monitored comprises examining one or more of TCP/UDP ports of the network traffic, patterns found in network traffic, stateful messages in the network traffic, or network traffic based on rate, payload lengths, and message sequence; and

upon finding the characteristics of the monitored internet content application in the network traffic, searching the sequence of reference points for the one or more content providers accessed by the subscriber, determine whether an entry exists for the sequence of reference points for the content provider that the subscriber is accessing; and

when an entry exists then updating the entry in the sequence of reference points with a new timestamp, and when the reference points do not exists, then a new sequence of reference points will be created, and reordering the sequence of reference points so that the most recent reference point is maintained at a head of a list;

correlating the internet content application with the one or more content providers accessed by the subscriber to determine a content provider for the internet content application; and

storing to a database the monitored internet content application and content providers originating the monitored internet content applications based on the reference points.

2. The method according to claim 1, further comprising deleting reference points for the subscriber after a predetermined amount of time has elapsed.

3. The method according to claim 1, wherein the step of monitoring the network traffic for the monitored internet content application comprises examining TCP/UDP ports of the network traffic.

4. The method according to claim 1, wherein the step of monitoring the network traffic for the monitored internet content application comprises examining patterns found in network traffic.

5. The method according to claim 1, wherein the step of monitoring the network traffic for the monitored internet content application comprises examining stateful messages in the network traffic.

6. The method according to claim 1, wherein the step of monitoring the network traffic for the monitored internet content application comprises examining the network traffic based on rate, payload lengths, and message sequences.

7. The method according to claim 1, wherein the step of maintaining a sequence of reference points for the subscriber comprises defining the subscriber to be monitored from a list of subscribers.

8. The method according to claim 1, wherein the step of maintaining a sequence of reference points for the subscriber comprises learning the subscriber to be monitored by monitoring the network traffic.

9. A system for correlating network traffic, the system comprising:

a memory configured to store instructions;

a processor disposed in communication with said memory, wherein said processor upon execution of the instructions is configured to;

determine one or more content providers accessed by a subscriber;

maintain a sequence of reference points for the subscriber, the sequence of reference points being ordered lists of the one or more content providers accessed by the subscriber;

monitor network traffic for characteristics of an internet content application to be monitored comprising examining one or more of TCP/UDP ports of the network traffic, patterns found in network traffic, stateful messages in the network traffic, or network traffic based on rate, payload lengths, and message sequence; and

upon finding the characteristics of the monitored internet content application in the network traffic, searching the sequence of reference points for the one or more content providers accessed by the subscriber, determine whether an entry exists for the sequence of reference points for the content provider that the subscriber is accessing; and

when an entry exists then updating the entry in the sequence of reference points with a new timestamp, and when the reference points do not exists, then a new sequence of reference points will be created, and reordering the sequence of reference points so that the most recent reference point is maintained at a head of a list;

correlate the internet content application with the one or more content providers accessed by the subscriber to determine a content provider for the internet content application; and

store to a database the monitored internet content application and content providers originating the monitored internet content applications based on the reference points.

10. The system according to claim 9, further comprising deleting reference points for the subscriber after a predetermined amount of time has elapsed.

11. The system according to claim 9, wherein monitoring the network traffic for the monitored internet content application comprises examining TCP/UDP ports of the network traffic.

12. The system according to claim 9, wherein monitoring the network traffic for the monitored internet content application comprises examining patterns found in network traffic.

13. The system according to claim 9, wherein monitoring the network traffic for the monitored internet content application comprises examining stateful messages in the network traffic.

14. The system according to claim 9, wherein monitoring the network traffic for the monitored internet content application comprises examining the network traffic based on rate, payload lengths, and message sequences.

15. The system according to claim 9, wherein maintaining a sequence of reference points for the subscriber comprises defining the subscriber to be monitored from a list of subscribers.

16. The system according to claim 9, wherein maintaining a sequence of reference points for the subscriber comprises learning the subscriber to be monitored by monitoring the network traffic.