Using a content delivery network for security monitoring

• US 9,231,966 B2
• Filed: 10/27/2014
• Issued: 01/05/2016
• Est. Priority Date: 08/26/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Serban, Cristina
• Primary Examiner(s): HOANG, HIEU T
• Application Number:
  US14/524,664
• Publication Number:
  US 20150047043A1
• Time in Patent Office: 435 Days
• Field of Search: 709/224, 709/227, 709/228
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/885 Monitoring specific for caches
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A content delivery network includes a plurality of cache servers. Each cache server is configured to receive a request for content from a client system and receive content and security data from a content server. Each cache server is further configured to provide the content to the client system and provide the security data to a monitoring system.

Claims

1. A system, comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations, the operations comprising;

retrieving a security data file from a cache server that received the security file from a content server in response to receiving a request for content from a client system, wherein the client system is remote from the system;

determining, based on the security data file, if a change in operation of the content server has occurred; and

generating an alert if the change in the operation of the content server has been determined to have occurred;

wherein determining if the change in the operation of the content server has occurred is based on a comparison of the security data file with a different data file retrieved from a different cache server.

2. The system of claim 1, wherein the operations further comprise disconnecting the content server from the system if the change in the operation of the content server has been determined to have occurred.

3. The system of claim 1, wherein the operations further comprise polling the cache server to determine if a new security data file is available.

4. The system of claim 3, wherein the operations further comprise retrieving the new security data file if the new security data file is determined to be available.

5. The system of claim 1, wherein the operations further comprise comparing system resource utilization to a historical pattern of system resource utilization to determine if the change in the operation of the content server has occurred.

6. The system of claim 1, wherein the operations further comprise transmitting the alert to a system administrator.

7. The system of claim 1, wherein the operations further comprise activating logging hardware to record network activity when the change in the operation of the content server has occurred, wherein the logging hardware is in a network associated with the system.

8. The system of claim 1, wherein the operations further comprise monitoring the content server when the change in the operation of the content server is determined to have occurred.

9. A method, comprising:

retrieving a security data file from a cache server that received the security file from a content server in response to receiving a request for content from a client system, wherein the client system is remote from the system;

determining, based on the security data file, if a change in operation of the content server has occurred; and

generating, by utilizing instructions from memory that are executed by a processor, an alert if the change in the operation of the content server has been determined to have occurred;

wherein determining if the change in the operation of the content server has occurred is based on a comparison of the security data file with a different data file retrieved from a different cache server.

10. The method of claim 9, further comprising disconnecting the content server from the system if the change in the operation of the content server has been determined to have occurred.

11. The method of claim 9, further comprising polling the cache server to determine if a new security data file is available.

12. The method of claim 11, further comprising retrieving the new security data file if the new security data file is determined to be available.

13. The method of claim 9, further comprising comparing system resource utilization to a historical pattern of system resource utilization to determine if the change in the operation of the content server has occurred.

14. The method of claim 9, further comprising transmitting the alert to a system administrator.

15. The method of claim 9, further comprising activating logging hardware to record network activity when the change in the operation of the content server has occurred, wherein the logging hardware is in a network associated with the system.

16. The method of claim 9, further comprising monitoring the content server when the change in the operation of the content server is determined to have occurred.

17. A computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

retrieving a security data file from a cache server that received the security file from a content server in response to receiving a request for content from a client system, wherein the client system is remote from the system;

determining, based on the security data file, if a change in operation of the content server has occurred; and

generating an alert if the change in the operation of the content server has been determined to have occurred;

wherein determining if the change in the operation of the content server has occurred is based on a comparison of the security data file with a different data file retrieved from a different cache server during a selected time period.