Near Real-Time Alerting of IP Traffic Flow to Subscribers

• US 20100054128A1
• Filed: 08/29/2008
• Published: 03/04/2010
• Est. Priority Date: 08/29/2008
• Status: Abandoned Application

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: O'Hern, William
• Application Number:
  US12/201,288
• Publication Number:
  US 20100054128A1
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

Methods, systems, and computer-readable media for providing near real-time alerts to users of IP traffic flow patterns on an IP network are provided. IP flow data collected from the network is periodically analyzed to determine if alerts need to be generated, based on a number of alert filters received from users. If alerts are to be generated, they are generated for transmission to the associated users.

Claims

1. A method for alerting users of Internet Protocol (IP) flow patterns, comprising:

analyzing IP flow data collected from an IP network to determine, based on one or more alert filters received from a user, whether to generate an alert; and

upon determining an alert is to be generated, generating the alert for transmission to the user.

2. The method of claim 1 further comprising:

collecting IP metadata from an Internet backbone network;

aggregating the IP metadata into IP flow data;

storing the IP flow data;

receiving one or more alert filters from a user; and

storing the one or more alert filters.

3. The method of claim 1, wherein the IP flow data comprises a plurality of IP flows.

4. The method of claim 3, wherein each of the plurality of IP flows comprises a timestamp, a source address, a destination address, and a protocol.

5. The method of claim 4, wherein each of the plurality of IP flows further comprises a packet count.

6. The method of claim 1, wherein each of the one or more alert filters comprises a protocol and a metric.

7. The method of claim 6 wherein the protocol comprises Hyper-text Transport Protocol (HTTP) and the metric comprises a destination address having a highest number of accesses by unique source address over a period of time.

8. A system for alerting users of Internet Protocol (IP) flow patterns, comprising:

an input for receiving collected IP flow data from an IP network and one or more alert filters from a user; and

an alerting service module operative to analyze the IP flow data to determine, based on the one or more alert filters, whether to generate an alert, and upon determining an alert is to be generated, generate the alert for transmission to the user.

9. The system of claim 8, wherein the IP flow data comprises a plurality of IP flows.

10. The system of claim 9, wherein each of the plurality of IP flows comprises a timestamp, a source address, a destination address, and a protocol.

11. The system of claim 8, wherein each of the one or more alert filters comprises a protocol and a metric.

12. The system of claim 11, wherein the protocol comprises Hyper-text Transport Protocol (HTTP) and the metric comprises a destination address having a highest number of accesses by unique source address over a period of time.

13. The system of claim 12, wherein the alert includes demographic data associated with the destination address.

14. A computer readable storage medium having computer executable instructions stored thereon that, when executed by a computer, cause the computer to:

analyze IP flow data collected from an IP network to determine, based on one or more alert filters received from a user, whether to generate an alert; and

upon determining an alert is to be generated, generate the alert for transmission to the user.

15. The computer readable storage medium of claim 14, wherein the IP flow data comprises a plurality of IP flows.

16. The computer readable storage medium of claim 15, wherein each of the plurality of IP flows comprises a timestamp, a source address, a destination address, and a protocol.

17. The computer readable storage medium of claim 16, wherein each of the plurality of IP flows further comprises a packet count.

18. The computer readable storage medium of claim 14, wherein each of the one or more alert filters comprises a protocol and a metric.

19. The computer readable storage medium of claim 18, wherein the protocol comprises Hyper-text Transport Protocol (HTTP) and the metric comprises a destination address having a highest number of accesses by unique source address over a period of time.

20. The computer readable storage medium of claim 19, wherein the alert includes demographic data associated with the destination address.