Intelligent network management device and method of managing network

• US 9,998,329 B2
• Filed: 07/23/2015
• Issued: 06/12/2018
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chao, Chih-Wen, Lee, Cheng-Ta, Suen, Wei-Shiau, Wu, Ming-Hsun
• Primary Examiner(s): Nowlin, Eric
• Application Number:
  US14/807,036
• Publication Number:
  US 20160036635A1
• Time in Patent Office: 1,055 Days
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 47/115 using a dedicated packet
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An intelligent network management device including an analytic unit, conducting an analysis according to received packets in order to determine whether a given event is occurred; and a processing unit, generating and sending a control instruction to a SDN controller to change configurations of a SDN switch when the analytic unit determined the given event has been occurred.

Claims

1. An intelligent network management device, disposed in a software-defined network (SDN) and connected to a SDN switch and a SDN controller used to control the SDN switch, the intelligent network management device comprising an analytic unit portion and a processing unit portion, wherein:

the analytic unit portion of the intelligent network management device is configured to conduct an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notify the processing unit portion of the intelligent network management device when the given event is determined to have occurred; and

the processing unit portion of the intelligent network management device is configured to generate and send an instruction to the SDN controller to change configurations of the SDN switch when the analytic unit portion of the intelligent network management device determines that the given event has occurred, wherein the configurations of the SDN switch are changed by the processing unit portion as directed by the analytic unit portion when the analytic unit portion determines that the given event has occurred so that the SDN switch sends packets originally destined to the intelligent network management device to another device on the SDN.

2. The intelligent network management device as claimed in claim 1, wherein the intelligent network management device is an intrusion prevention system (IPS) device.

3. The intelligent network management device as claimed in claim 1, wherein the instruction is an instruction to change configurations of the SDN switch to block subsequent attack packets, and wherein the processing unit portion of the intelligent network management device sends the instruction to the SDN switch instructing the SDN switch to block the subsequent attack packets.

4. The intelligent network management device as claimed in claim 1, wherein the intelligent network management device and the SDN switch are operatively coupled to an appliance.

5. The intelligent network management device as claimed in claim 4, wherein the intelligent network management device is configured to receive decrypted packets decrypted by the appliance.

6. An intelligent network management device, disposed in a software-defined network (SDN) and connected to a SDN switch and a SDN controller used to control the SDN switch, the intelligent network management device comprising an analytic unit portion and a processing unit portion, wherein:

the analytic unit portion of the intelligent network management device is configured to conduct an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notify the processing unit portion of the intelligent network management device when the given event is determined to have occurred; and

the processing unit portion of the intelligent network management device is configured to generate and send an instruction to the SDN controller to change configurations of the SDN switch when the analytic unit portion of the intelligent network management device determines that the given event has occurred, wherein the configurations of the SDN switch are changed so that the SDN switch at least affects subsequent packets sent to the intelligent network management device in the SDN, and wherein the given event determined by the analytic unit portion of the intelligent network management device is a congestion event and the configuration of the SDN switch is changed by the SDN controller such that the SDN switch accordingly stops sending packets matching a predetermined condition to the intelligent network management device.

7. A network management method, used in the intelligent network management device comprising an analytic unit configured to conduct an analysis according to packets received by the intelligent network management device via a software-defined network (SDN) switch to determine whether a given event has occurred;

and a processing unit configured to generate and send an instruction to an SDN controller configured to change configurations of the SDN switch when the analytic unit determines that the given event has occurred, the method comprising;

conducting an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notifying the processing unit when the given event is determined to have occurred; and

generating and sending an instruction to the SDN controller to change configurations of the SDN switch when the analytic unit determines that the given event has occurred, wherein the configurations of the SDN switch are changed by the processing unit portion as directed by the analytic unit portion when the analytic unit portion determines that the given event has occurred so that the SDN switch sends packets originally destined to the intelligent network management device to another device on the SDN.

8. A computer program product comprising a non-transitory computer usable storage device having program code embodied thereon that is configured to perform, when executed by a data processor, the method of claim 7.

9. An intelligent network management device, disposed in a software-defined network (SDN) and connected to a SDN switch and a SDN controller used to control the SDN switch, the intelligent network management device comprising an analytic unit portion and a processing unit portion, wherein:

the analytic unit portion of the intelligent network management device is configured to conduct an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notify the processing unit portion of the intelligent network management device when the given event is determined to have occurred; and

the processing unit portion of the intelligent network management device is configured to generate and send an instruction to the SDN controller to change configurations of the SDN switch when the analytic unit portion of the intelligent network management device determines that the given event has occurred, wherein the intelligent network management device is configured to block packets received from the SDN switch, and wherein the processing unit portion of the intelligent network management device is configured to select, based on a load of the intelligent network management device, one of the intelligent network management device and the SDN switch to block packets.

10. An intelligent network management device, disposed in a software-defined network (SDN) and connected to a SDN switch and a SDN controller used to control the SDN switch, the intelligent network management device comprising an analytic unit portion and a processing unit portion, wherein:

the analytic unit portion of the intelligent network management device is configured to conduct an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notify the processing unit portion of the intelligent network management device when the given event is determined to have occurred; and

the processing unit portion of the intelligent network management device is configured to generate and send an instruction to the SDN controller to change configurations of the SDN switch when the analytic unit portion of the intelligent network management device determines that the given event has occurred, wherein the intelligent network management device is configured to block packets received from the SDN switch, and wherein the given event determined by the analytic unit portion of the intelligent network management device is a congestion event, and the processing unit portion of the intelligent network management device instructs the SDN switch to let packets with lower priority levels bypass the intelligent network management device and continue to be sent to a destination so as to reduce network flow handled by the intelligent network management device.