Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof

• US 9,985,976 B1
• Filed: 02/01/2016
• Issued: 05/29/2018
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Rovniaguin, Dmitry, Dan, Ephraim, Talmor, Ron
• Primary Examiner(s): Lwin, Maung
• Application Number:
  US15/012,458
• Time in Patent Office: 848 Days
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A method, non-transitory computer readable medium, and device that identifies network traffic characteristics to correlate and manage one or more subsequent flows includes transmitting a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request. The HTTP request is transmitted to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server. An HTTP response to the HTTP request is received from the application server. An operation with respect to the HTTP response is performed.

Claims

1. A method for identifying network traffic characteristics to correlate and manage one or more subsequent flows, the method implemented by a network traffic management system comprising one or more network traffic apparatuses, client devices, or server devices, and, the method comprising:

transmitting a monitoring request comprising a client identification and a session identification extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmitting the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receiving an HTTP response to the HTTP request from the application server;

transmitting a monitoring response message to end the correlation associated with the HTTP request; and

performing at least one operation associated with the client identification and a session identification with respect to the received HTTP response when a command message in a response to the monitoring response message is not received before a determined period of time elapses.

2. The method of claim 1, wherein the performing further comprises:

outputting the HTTP response to the requesting client computing device.

3. The method of claim 1, further comprising:

receiving a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing, by the traffic management computing device, the determined action on the HTTP response.

4. The method of claim 3, wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, or terminating, by the traffic management computing device, the output of the HTTP response to the requesting client computing device.

5. The method of claim 1, wherein the monitoring request further comprise one or more request values.

6. A non-transitory computer readable medium having stored thereon instructions for identifying network traffic characteristics to correlate and manage one or more subsequent flows comprising machine executable code which when executed by at least one processor, causes the processor to:

transmit a monitoring request comprising a client identification and a session identification extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmit the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receive an HTTP response to the HTTP request from the application server;

transmit a monitoring response message to end the correlation associated with the HTTP request; and

perform at least one operation associated with the client identification and a session identification with respect to the received HTTP response when a command message in a response to the monitoring response message is not received before a determined period of time elapses.

7. The medium of claim 6, wherein the performing further comprises outputting the HTTP response to the requesting client computing device.

8. The medium of claim 6, further comprising receive a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing the determined action on the HTTP response.

9. The medium of claim 8, wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, or terminating the output of the HTTP response to the requesting client computing device.

10. The medium of claim 6, wherein the monitoring request further comprise one or more request values.

11. A network traffic manager apparatus, comprising memory including programmed instructions stored in the memory and one or more processors configured to be capable of executing the programmed instructions stored in the memory to:

transmit a monitoring request comprising a client identification and a session identification extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmit the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receive an HTTP response to the HTTP request from the application server;

transmit a monitoring response message to end the correlation associated with the HTTP request; and

perform at least one operation associated with the client identification and a session identification with respect to the received HTTP response when a command message in a response to the monitoring response message is not received before a determined period of time elapses.

12. The apparatus of claim 11, wherein the performing further comprises outputting the HTTP response to the requesting client computing device.

13. The apparatus of claim 11, wherein the one or more processors are further configured to be capable of executing the programmed instructions stored in the memory to receive a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing the determined action on the HTTP response.

14. The apparatus of claim 13, wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, or terminating the output of the HTTP response to the requesting client computing device.

15. The apparatus of claim 11, wherein the monitoring request further comprise one or more request values.

16. A network traffic management system, comprising:

one or more traffic management apparatuses, client devices, or server devices, the network traffic management system comprising memory including programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to;

transmit a monitoring request comprising a client identification and a session identification extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmit the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receive an HTTP response to the HTTP request from the application server;

transmit a monitoring response message to end the correlation associated with the HTTP request; and

perform at least one operation associated with the client identification and a session identification with respect to the received HTTP response when a command message in a response to the monitoring response message is not received before a determined period of time elapses.