Systems and methods for adaptive monitoring with bandwidth constraints

• US 20050174961A1
• Filed: 02/06/2004
• Published: 08/11/2005
• Est. Priority Date: 02/06/2004
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E.
• Granted Patent: US 7,355,996 B2
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 28/20 Negotiating bandwidth
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]

Abstract

This application is directed to systems and methods for adaptive monitoring of a wireless network with bandwidth constraints. A data unit from a wireless node is received. When a bandwidth constraint is satisfied, the received data unit is buffered. When the bandwidth constraint is not satisfied, the received or buffered data unit is transmitted to a monitoring processor. In some instances, downsampling, data discard and data aggregation can occur during the buffering process.

Claims

1. A method of monitoring a wireless network, the method comprising the steps of:

(a) receiving a data unit from a wireless node;

(b) if a bandwidth constraint is satisfied, buffering the received data unit; and

(c) transmitting the received or buffered data unit to a monitoring processor.

2. The method of claim 1, and further comprising the steps of receiving the bandwidth constraint.

3. The method of claim 2, wherein the bandwidth constraint is received from a local data store, a wired network node, a wireless network node, an access point or a sensor.

4. The method of claim 2, and further comprising the step of requesting the bandwidth constraint.

5. The method of claim 1, and further comprising the step of determining the bandwidth constraint.

6. The method of claim 5, wherein the step of determining the bandwidth constraint is based at least in part upon local data, data received from a wired network node, data received from a wireless network node, data received from an access point, data received from a sensor or combinations thereof.

7. The method of claim 1, and further comprising the step of downsampling when the bandwidth constraint is satisfied.

8. The method of claim 7, wherein the step of downsampling occurs when a local storage constraint is satisfied.

9. The method of claim 8, wherein the step of downsampling only occurs when the local storage constraint is satisfied.

10. The method of claim 7, wherein the step of downsampling comprises one or more steps selected from the group consisting of:

(i) discarding the received data unit if it is redundant with a previously buffered data unit;

(ii) aggregating the received data unit with a previously buffered data unit;

(iii) discarding the received data unit if it comprises network control data;

(iv) discarding the received data unit if it is associated with a device that has already been observed more frequently than other devices; and

(v) discarding the received data unit if the wireless node is determined to be a low threat node.

11. The method of claim 1, and further comprising the step of repeating steps (a) through (c) for a plurality of wireless nodes.

12. The method of claim 11, and further comprising the step of selecting the wireless node from the plurality for a given repetition.

13. The method of claim 12, wherein the selecting step is based upon random selection.

14. The method of claim 12, wherein the selecting step is based upon a deterministic selection.

15. The method of claim 14, wherein the deterministic selection is a sequential traversal of the plurality, a selection based upon amount of buffered data for each wireless node in the plurality, a selection based upon a threat level for each wireless node in the plurality or combinations thereof.

16. The method of claim 11, wherein the transmitting step occurs at a rate determined based upon the bandwidth constraint and current bandwidth useage.

17. The method of claim 1, and further comprising the step of repeating steps (a) through (c) for a plurality of received data units from the wireless node.

18. The method of claim 17, wherein the transmitting step occurs at a rate determined based upon the bandwidth constraint and current bandwidth useage.

19. The method of claim 1, wherein the transmitting step occurs at a time based upon whether the bandwidth constraint is satisfied.

20. The method of claim 19, wherein the transmitting step comprises immediately transmitting the received data unit if the bandwidth constraint is not satisfied.

21. The method of claim 19, wherein the transmitting step further comprises transmitting the buffered data unit at a point in time when the bandwidth constraint is not satisfied.

22. One or more computer readible media storing instruction that upon execution by a system processor cause the system processor to monitor a wireless network by performing the methods of any of claims 1 through 21.

23. A system of monitoring a wireless network, the system comprising:

(a) a system data store (SDS) comprising capable of storing wireless data transmitted by a wireless node and configuration information at least comprising a bandwidth constraints;

(b) a wireless receiver capable of receiving one or more data units from a wireless node;

(c) a communication interface allowing communication with a monitoring processor; and

(d) a system processor in communication with the SDS, the wireless receiver and the communication interface, wherein the system processor comprises one or more processing elements programmed or adapted to;

(i) receive a data unit from the wireless receiver in response to receipt of the data unit by the wireless receiver from a wireless node;

(ii) buffer the received data unit in the SDS if a bandwidth constraint is satisfied;

(iii) immediately transmit the received data unit to the monitoring process via the communication interface if the bandwidth constraint is not satisfied;

(iv) repeat steps (i) through (iii) for a plurality of received data units;

(v) discard the received data unit if the bandwidth constraint is satisfied, if a local storage constraint has been satisfied and if the received data unit is redundant with a previously buffered data unit, comprises network control data, is associated with a device that has already been observed more frequently than other devices or originates from a low threat wireless node;

(vi) aggregate the received data unit with a previously buffered data unit if the bandwidth constraint is satisfied and if the received data unit is compatible with the previously buffered data unit; and

(vii) transmit a selected buffered data unit to the to the monitoring process via the communication interface at a point in time after receipt based upon the bandwidth constraint and bandwidth useage.

24. A system of monitoring a wireless network, the system comprising:

(a) receiving means for receiving a data unit from a wireless node;

(b) buffer means for accepting for buffering a received data unit from the receiving means if a bandwidth constraint is satisfied, aggregating the accepted data unit with a previously buffered data unit if the accepted data unit is compatible with the previously buffered data unit, discarding the accepted data unit if a storage constraint is satisfied and if the accepted data unit is redundant with a previously buffered data unit, comprises network control data, is associated with a device that has already been observed more frequently than other devices or originates from a low threat wireless node; and

(c) output means for immediately transmitting a received data unit to a monitoring processor if the bandwidth constraint is not satisfied and for transmitting a buffered data unit to the monitoring processor at a point in time after receipt based upon the bandwidth constraint and bandwidth useage.