Incremental application of resources to network traffic flows based on heuristics and business policies

• US 9,825,868 B2
• Filed: 09/28/2016
• Issued: 11/21/2017
• Est. Priority Date: 04/11/2014
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Caputo, II, Pete Joseph, Sella, William Thomas
• Primary Examiner(s): Chu, Wutchung
• Application Number:
  US15/279,289
• Publication Number:
  US 20170019339A1
• Time in Patent Office: 419 Days
• Field of Search: 709224, 709223, 709225, 709205, 370235, 370252, 370241, 370230, 370392
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/243 using M+N parallel active paths
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Disclosed herein are system, method, and computer program product embodiments for increasingly applying network resources to traffic flows based on heuristics and policy conditions. A network determines that a traffic flow satisfies a first condition and transmits a first portion of the traffic flow to a network service. A network service then inspects the first portion of the traffic flow at a first level of detail and determines that the traffic flow satisfies a second condition. The network can then transmit a second portion of the traffic flow to the network service based on the determining the traffic flow satisfies the second condition. The network service can inspect the second portion of the traffic flow at a second level of detail, wherein the inspecting at the second level of detail requires a different amount of computing resources than the inspecting at the first level of detail.

Claims

1. A system comprising:

a data collection module configured to collect data belonging to a plurality of traffic flows from a plurality of routers;

a controller; and

an analytics module configured to;

received data from the data collection module,

retrieve from a policy data base a set of policy rules for a traffic flow among the plurality of traffic flows,

determine if any data packets belonging to the traffic flow matches a first policy rule within the set of policy rules,

in response to determining that the traffic flow satisfies the first policy rule, send policy compliance information about the traffic flow to the controller,

wherein the controller is configured to;

receive policy compliance information about the plurality of traffic flows from the analytics module, and

in response to receiving policy compliance information about the traffic flow from the analytics module, configure one or more routers to transmit a first portion of the traffic flow to a network service provider

in response to determining that the traffic flow satisfies a second policy rule, send a request to receive a second portion of the traffic flow, wherein the second portion of the traffic flow comprises a larger amount of information than the first portion of the traffic flow; and

in response to receiving the second portion of the traffic flow, inspect the second portion of the traffic flow at a second level of detail, wherein the inspecting at the second level of detail requires a different amount of computing resources than the inspecting the first portion of the traffic at the first level of detail.

2. The system of claim 1, wherein the controller is configured to transmit the first portion of the traffic flow to the network service provider by duplicating the first portion of the traffic flow to the network service provider.

3. The system of claim 1, wherein the controller is configured to transmit the first portion of the traffic flow to the network service provider by re-routing the first portion of the traffic flow to the network service provider.

4. The system of claim 1, wherein the first policy rule comprises a parameter associated with the traffic flow and a level of security desired for the traffic flow.

5. The system of claim 1, wherein the set of policy rules retrieved for the traffic flow comprise information associated with at least one of a network client, a pair of source and destination addresses, and an application program.

6. The system of claim 1, wherein the network service provider is remote from the controller, the data collection module and the analytics module.

7. A network service provider configured to:

receive a first portion of a traffic flow;

inspect the first portion of the traffic flow at a first level of detail based on a first condition;

determine, based on the inspecting, that the traffic flow satisfies a second condition;

in response to determining that the traffic flow satisfies the second condition, send a request to receive a second portion of the traffic flow, wherein the second portion of the traffic flow comprises a larger amount of information than the first portion of the traffic flow; and

in response to receiving the second portion of the traffic flow, inspect the second portion of the traffic flow at a second level of detail, wherein the inspecting at the second level of detail requires a different amount of computing resources than the inspecting at the first level of detail.

8. The network service provider of claim 7, wherein the first portion of the traffic flow comprises a random sample of packets.

9. The network service provider of claim 7, wherein the first portion of the traffic flow comprises duplicate packets of a subset of the traffic flow.

10. The network service provider of claim 7, wherein the first portion of the traffic flow contains a subset of the traffic flow re-routed through the network service provider.

11. The network service provider of claim 10, further configured to transmit the first portion of the traffic flow to a router, wherein the transmitting occurs after the inspecting.

12. The network service provider of claim 10, further configured to transmit the second portion of the traffic flow to a router, wherein the transmitting occurs after the inspecting.

13. The network service provider of claim 7, wherein the first and second conditions comprise one of a heuristic, a policy associated with the traffic flow, or an event of interest.

14. The network service provider of claim 7, wherein the inspecting the first portion of the traffic flow at the first level of detail comprises inspecting the header information of packets belonging to the traffic flow.

15. The network service provider of claim 7, wherein the inspecting the second portion of the traffic flow at the second level of detail comprises performing an intrusion detection analysis.

16. The network service provider of claim 7, wherein the inspecting the second portion of the traffic flow at the second level of detail comprises inspecting a header and the payload information of the packets belonging to the traffic flow.

17. The network service provider of claim 7, further configured to:

receive a third portion of the traffic flow based on the inspecting the traffic flow at the second level of detail; and

inspecting the third portion of the traffic flow at a third level of detail.

18. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:

(a) receiving a plurality of data packets belonging to a plurality of traffic flows;

(b) retrieving a set of policy rules for a traffic flow among the plurality of traffic flows from a policy data base;

(c) determining if any of the data packets belonging to the traffic flow matches a first policy rule within the set of policy rules;

(d) sending policy compliance information to a controller in response to determining in (c);

(e) in response to receiving policy compliance information about the traffic flow, configuring one or more routers to transmit a first portion of the traffic flow to a network service provider; and

in response to determining that the traffic flow satisfies a second policy rule, send a request to receive a second portion of the traffic flow, wherein the second portion of the traffic flow comprises a larger amount of information than the first portion of the traffic flow; and

in response to receiving the second portion of the traffic flow, inspect the second portion of the traffic flow at a second level of detail, wherein inspecting at the second level of detail requires a different amount of computing resources than inspecting the first portion of the traffic at a first level of detail.

19. The computer-readable medium of claim 18, wherein the controller is configured to transmit the first portion of the traffic flow to the network service provider by duplicating the first portion of the traffic flow to the network service provider.

20. The computer-readable medium of claim 18, wherein the controller is configured to transmit the first portion of the traffic flow to the network service provider by re-routing the first portion of the traffic flow to the network service provider.