System and method for real-time analysis of network traffic

• US 9,955,023 B2
• Filed: 10/13/2017
• Issued: 04/24/2018
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: Network Kinetix, Llc
• Original Assignee: Network Kinetix, Llc
• Inventors: Richards, Carissa, Richards, Peter
• Primary Examiner(s): KATSIKIS, KOSTAS J
• Application Number:
  US15/783,446
• Publication Number:
  US 20180041643A1
• Time in Patent Office: 193 Days
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/8214 Data or packet based
• CPC Class Codes: H04M 15/8228 Session based
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system for monitoring a live-data flow through a network includes at least one server communicating with the network. A processor within each of the at least one server implements a first processing node for monitoring a mirrored live-data flow of the live-data flow passing through at least one selected point within the network in a non-intrusive manner that does not affect the live-data flow passing through the at least one selected point. The first processing node decodes data within the mirrored live-data flow according to each protocol associated with the data. The first processing node detects at least one predetermined or deduced condition defined by at least one of a plurality of applications implemented on a second processing node and executes at least one predetermined or deduced response responsive to an indication of occurrence of the at least one predetermined or deduced condition within the decoded data. The first processing node also forwards data from the first processing node to a second processing node data from at least one of the plurality of simultaneous live-data flows based upon occurrence of the at least one predetermined or deduced condition. The processor within the at least one server the processor further implements the second processing node for accessing from the second processing node, external data from an external data source. The second processing node also processes at least a portion of the data forwarded from the first processing node using at least one of the plurality of applications implemented on the second processing node and the external data. The processing of the data by the at least one of the plurality of applications and the external data causes execution of the at least one predetermined or deduced response to determine a manner for controlling an operation of the network at a same time the live-data flow is in active transmission between the endpoints in the network. The operation of the network is controlled in response to the executed at least one predetermined or deduced response while events associated with the live-data flow are occurring within the network.

Claims

1. A system for monitoring a live-data flow through a network, comprising:

at least one server communicating with the network;

at least one network interface associated with the at least one server for providing access to the live-data flow through the network;

a processor within each of the at least one server, the processor implementing a first processing node for;

monitoring, at the first processing node, a mirrored live-data flow of the live-data flow passing through at least one selected point within the network in a non-intrusive manner that does not affect the live-data flow passing through the at least one selected point, wherein the live-data flow comprises a plurality of simultaneous live-data flows that are in active transmission between endpoints in the network and prior to onward storage of the data in a database;

decoding, at the first processing node, data within the mirrored live-data flow according to each protocol associated with the data, wherein the data has a plurality of protocols associated therewith, and the data is decoded in parallel according to each of the plurality of protocols;

detecting, at the first processing node, at least one predetermined or deduced condition defined by at least one of a plurality of applications implemented on a second processing node;

executing at least one predetermined or deduced response responsive to an indication of occurrence of the at least one predetermined or deduced condition within the decoded data;

forwarding from the first processing node to the second processing node data from at least one of the plurality of simultaneous live-data flows based upon occurrence of the at least one predetermined or deduced condition defined by the at least one of the plurality of applications implemented on the second processing node;

the processor within the at least one server the processor further implementing the second processing node for;

accessing from the second processing node, external data from an external data source;

processing, at the second processing node, at least a portion of the data forwarded from the first processing node using at least one of the plurality of applications implemented on the second processing node and the external data, the processing of the data by the at least one of the plurality of applications and the external data causing execution of the at least one predetermined or deduced response to determine a manner for controlling an operation of the network at a same time the live-data flow is in active transmission between the endpoints in the network; and

controlling the operation of the network in response to the executed at least one predetermined or deduced response while events associated with the live-data flow are occurring within the network.

2. The system of claim 1, wherein the processor further implements the second processing node to enable access to the external data from within the second processing node.

3. The system of claim 1, wherein the processor further implements the second processing node to enable access to the external data from a location located outside of the second processing node.

4. The system of claim 1, wherein the processer further implements the second processing node to access the external data from the external data source responsive to rules established by the at least one of the plurality of applications implemented on the second processing node and conditions of the live-data flow.

5. The system of claim 4, wherein the access to the external data further comprises a dynamic or programmatic access to the external data from the external data source responsive to the rules established by the at least one of the plurality of applications implemented at the second processing node and the conditions of the live-data flow.

6. The system of claim 1, wherein each of the second processing nodes of the at least one server are configured to access external data from one of a plurality of external data sources depending on requirements established by the at least one of the plurality of applications implemented on the second node.

7. The system of claim 1, wherein the server further implements the second processing node for integrating, correlating and contextualizing the accessed external data with the live data flow.

8. The system of claim 1, wherein the external data is used for supporting functions operating on at least one of the first processing node and the second processing node.

9. The system of claim 8, wherein the functions operating on at least one of the first processing node and the second processing node comprise at least one of decision support, decision accuracy, situational relevancy, situational analysis, contextual reasoning, contextual deduction, deductive processing and time-critical situational analysis.

10. The system of claim 1, wherein the first processing node is further configured for dynamically updating the live data flow of the plurality of simultaneous live-data flows that are in active transmission between endpoints in the network that is monitored, decoded and forwarded to the second processing node responsive at least in part to the external data.

11. The system of claim 1, wherein the second processing node is further configured to dynamically calculate whether to update the at least one predetermined or deduced condition defined by the at least one of the plurality of applications implemented at the second processing node responsive at least in part to the external data.

12. The system of claim 1, wherein the second processing node is further configured to provide additional contextual information for configuring the second processing node to generate responses, alerts and actions to control the network responsive at least in part to the external data.

13. The system of claim 12, wherein the second processing node is further configured to generate a type of alert or action and a location, recipient and manner of transmission of the alert or action responsive at least in part to the external data.

14. The system of claim 12, wherein the second processing node is further configured to compare current or predicted network conditions with baseline network conditions.

15. The system of claim 1, wherein the second processing node is further configured to build the external data source dynamically as the mirrored live data flow is processed.

16. The system of claim 14, wherein the second processing node is further configured to perform long-term modeling and feedback to the second processing node responsive to the external data within the dynamically built external data source.

17. A method for monitoring live-data flow through a network, comprising:

monitoring, at the first processing node, a mirrored live-data flow of the live-data flow passing through at least one selected point within the network in a non-intrusive manner that does not affect the live-data flow passing through the at least one selected point, wherein the live-data flow comprises a plurality of simultaneous live-data flows that are in active transmission between endpoints in the network and prior to onward storage of the data in a database;

decoding, at the first processing node, data within the mirrored live-data flow according to each protocol associated with the data, wherein the data has a plurality of protocols associated therewith, and the data is decoded in parallel according to each of the plurality of protocols;

detecting, at the first processing node, at least one predetermined or deduced condition defined by at least one of a plurality of applications implemented on a second processing node;

executing at least one predetermined or deduced response responsive to an indication of occurrence of the at least one predetermined or deduced condition within the decoded data;

forwarding from the first processing node to the second processing node data from at least one of the plurality of simultaneous live-data flows based upon occurrence of the at least one predetermined or deduced condition defined by the at least one of the plurality of applications implemented on the second processing node;

accessing from a second processing node, external data from an external data source;

processing, at the second processing node, at least a portion of the data forwarded from the first processing node using at least one of the plurality of applications implemented on the second processing node and the external data, the processing of the data by the at least one of the plurality of applications and the external data causing execution of the at least one predetermined or deduced response to determine a manner for controlling an operation of the network at a same time the live-data flow is in active transmission between the endpoints in the network; and

controlling the operation of the network in response to the executed at least one predetermined or deduced response while events associated with the live-data flow are occurring within the network.

18. The method of claim 17 further including enabling access to the external data from within the second processing node.

19. The method of claim 17 further including enabling access to the external data from a location located outside of the second processing node.

20. The method of claim 17, wherein the accessing further comprises accessing the external data from the external data source responsive to rules established by the at least one of the plurality of applications implemented on the second processing node and conditions of the live-data flow.

21. The method of claim 17, wherein the accessing to the external data further comprises dynamically or programmatically accessing the external data from the external data source responsive to the rules established by the at least one of the plurality of applications implemented at the second processing node and the conditions of the live-data flow.

22. The method of claim 17, wherein accessing further comprises accessing external data from one of a plurality of external data sources depending on requirements established by the at least one of the plurality of applications implemented on the second node.

23. The method of claim 17, wherein the processing by the second processing node further comprises integrating, correlating and contextualizing the accessed external data with the live data flow.

24. The method of claim 17 further comprising supporting functions operating on at least one of the first processing node and the second processing node using the external data.

25. The method of claim 24, wherein the functions operating on at least one of the first processing node and the second processing node comprises at least one of decision support, decision accuracy, situational relevancy, situational analysis, contextual reasoning, contextual deduction, deductive processing and time-critical situational analysis.

26. The method of claim 17 further comprising dynamically updating, at the first processing node, the live data flow of the plurality of simultaneous live-data flows that are in active transmission between endpoints in the network that is monitored, decoded and forwarded to the second processing node responsive at least in part to the external data.

27. The method of claim 17, further comprising dynamically calculating, at the second processing node, whether to update the at least one predetermined or deduced condition defined by the at least one of the plurality of applications implemented at the second processing node responsive at least in part to the external data.

28. The method of claim 17, further comprising providing additional contextual information for configuring the second processing node to generate responses, alerts and actions to control the network responsive at least in part to the external data.

29. The method of claim 28 further comprising generating a type of alert or action and a location, recipient and manner of transmission of the alert or action responsive at least in part to the external data.

30. The method of claim 28 further comprising comparing, at the second processing node, current or predicted network conditions with baseline network conditions.

31. The method of claim 17 further comprising building the external data source dynamically as the mirrored live data flow is processed.

32. The method of claim 31 further comprising performing, at the second processing node, long-term modeling and feedback to the second processing node responsive to the external data within the dynamically built external data source.