Dynamic network tuner for the automated correlation of networking device functionality and network-related performance

• US 9,747,439 B2
• Filed: 02/06/2006
• Issued: 08/29/2017
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Hiscock, James S.
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US11/347,893
• Publication Number:
  US 20070192860A1
• Time in Patent Office: 4,222 Days
• Field of Search: 726 23- 26
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A dynamic network tuner establishes fluid, continuous, and automatic correlation between the extent and/or degree of a networking device'"'"'s functionality, on the one hand, and the network-related performance (i.e., network data traffic and/or network application performance), on the other. The dynamic network tuner can be embodied as a discrete device ready for installation into a host network. Preferably, such (and like) tuner embodiments are integrated into a network to automatically correlate, according to user-predefined parameters, the network'"'"'s performance with the operation within the network of specifically-targeted, performance-altering networking devices, such as network security devices, or more preferably and particularly, intrusion prevention devices.

Claims

1. A network comprising two or more nodes communicably linked to enable transmission of data packets there between, the network further comprising:

an intrusion prevention system to execute a filter protocol from a filter protocol set on a data packet upon detection by the intrusion prevention system of a real or potential network threat, said execution of said filter protocol effecting substantially said transmission of data packets;

a network-related performance monitor to monitor at least one network-related performance parameter and generating network-related performance information based upon the at least one network-related performance parameter;

a tuning agent to obtain or receive said network-related performance information from said network-related performance monitor and based upon the network-related performance information, and in a substantially automatic predetermined response thereto, one of effecting said execution of said filter protocol and effecting a modification of said filter protocol set; and

a processor to implement the tuning agent.

2. The network of claim 1, wherein said intrusion prevention system is installed inline with respect to said transmission of data packets to enable execution of said filter protocol on each said data packet passing therethrough.

3. The network of claim 2, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

4. The network of claim 2, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

5. The network of claim 3, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

6. The network of claim 1, wherein the tuning agent comprises, housed within a common enclosure:

means for communicating with said network-related performance monitor;

means for communicating with said intrusion prevention system; and

means for accomplishing said substantially automatic predetermined response.

7. The network of claim 6, wherein said network-related performance monitor is also housed within said common enclosure.

8. The network of claim 6, wherein said intrusion prevention system is also housed within said common enclosure.

20. The network of claim 1, wherein one of effecting said execution of said filter protocol, said detection by the intrusion prevention system, and effecting a modification to said filter protocol set is to correlate operation of the intrusion prevention system with the at least one network-related performance parameter.

9. A network comprising:

two or more nodes communicably linked to enable transmission of data packets therebetween;

at least one networking device for executing, on a data packet, a specified protocol or application effecting substantially said transmission of data packets upon detection by the at least one networking device of a real or potential network threat;

a network-related performance monitor for monitoring at least one network-related performance parameter and generating network-related performance information based upon the at least one network-related performance parameter; and

a tuning agent to obtain or receive said network-related performance information from said network-related performance monitor and based upon the network-related performance information indicating that the monitored at least one network-related performance parameter is to be tuned, and in a substantially automatic predetermined response thereto, effecting a modification of said specified protocol or application.

10. The network of claim 9, wherein the tuning agent comprises, housed within a common enclosure:

means for communicating with said network-related performance monitor;

means for communicating with said networking device; and

means for accomplishing said substantially automatic predetermined response.

11. The network of claim 9, wherein said network-related performance monitor in also housed within said common enclosure.

12. A dynamic network tuner configured for installation and use in a network, wherein said network comprises two or more nodes, a network-related performance monitor, and a networking device for executing a specified protocol or application that substantially effects data packet transmission within said network, and wherein the dynamic network tuner comprises, housed within a common enclosure:

a processor;

a memory on which is stored machine readable instructions to cause the processor to;

communicate with said network-related performance monitor to obtain or receive network-related performance information;

communicate with said networking device; and

effect a modification of said specified protocol or application based upon the network-related performance information indicating that the monitored network-related performance is to be tuned, wherein the networking device is to execute the specified protocol or application on a data packet upon detection by the networking device of a real or potential network threat.

13. The dynamic network tuner of claim 12, wherein said networking device is an in-line intrusion prevention system to execute a filter protocol from a filter protocol set upon detection by the intrusion prevention system of the real or potential network threat, said filter protocol being said specified protocol or application.

14. The dynamic network tuner of claim 13, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

15. The dynamic network tuner of claim 13, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.

16. A dynamic network tuner and monitor configured for installation and use in a network, said network comprising two or more nodes and at least one networking device for executing a specified protocol or application that substantially effects data packet transmission within said network, the dynamic network tuner and monitor comprising, housed within a common enclosure:

a network-related performance monitor to monitor at least one network-related performance parameter and generate network-related performance information based upon the at least one network-related performance parameter;

a tuning agent to effect a modification of said specified protocol or application based upon said at least one network-related performance information indicating that the monitored at least one network-related performance parameter is to be tuned, wherein the at least one networking device is to execute the specified protocol or application on a data packet upon detection by the at least one networking device of a real or potential network threat; and

a processor to implement the tuning agent.

17. The dynamic network tuner and monitor of claim 16, wherein said networking device is an in-line intrusion prevention system to execute a filter protocol from a filter protocol set upon detection by the intrusion prevention system of a real or potential network threat, said filter protocol being said specified protocol or application.

18. The dynamic network tuner and monitor of claim 17, wherein said detection by the said intrusion prevention system involves inspection of both payload and header information in each said data packet passing therethrough.

19. The dynamic network tuner and monitor of claim 17, wherein the execution of said filter protocol involves classification of said data packets passing therethrough into good, bad, and suspicious packets.