MESSAGE-BASED COMMUNICATION SYSTEM MONITOR

• US 20100332651A1
• Filed: 12/09/2008
• Published: 12/30/2010
• Est. Priority Date: 12/20/2007
• Status: Active Grant

• Current Assignee: Inria Institut National de Recherche EN Informatique et EN Automatique
• Original Assignee: Inria Institut National de Recherche EN Informatique et EN Automatique
• Inventors: Festor, Olivier, State, Radu, Abdelnur, Humbert Jorge
• Granted Patent: US 8,688,824 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

Message-based communication system monitor, comprising an inspector (16) capable of inspecting a message so as to determine whether it satisfies a specific pattern of a source, characterized in that it comprises an analyser (12) capable of inspecting a communication stream, so as to derive therefrom a structured representation of messages, in correspondence with a plurality of rules, and in that the inspector (16) is devised so as to: *apply a stored pattern to a structured representation of the inspected message, so as to establish a signature, and *compare the signature with reference data, so as to classify the inspected message in the case of correspondence.

Claims

1. Message-based communications system monitor, comprising an inspector (16) capable of inspecting a message in order to determine whether it satisfies a specific pattern of a source, characterised in that it comprises an analyser (12) capable of inspecting a communication stream so as to derive from it a structured representation of messages, in correspondence with a set of rules, and in that the inspector (16) is designed to:

apply a stored pattern to a structured representation of the message inspected, to establish a signature, and

compare the signature with reference pattern$, in order to classify the inspected message in the event of correspondence.

2. Message-based communications system monitor, characterised in that it comprises:

an analyser (12) capable of inspecting a communication stream so as to derive from it a structured representation of messages, in correspondence with a set of rules,

a discriminator (14) capable of comparing structured representations relating to a number of message sources, so as to derive from them selective patterns of respective sources.

3. Monitor according to claim 2, characterised in that the discriminator comprises:

a comparator capable of utilising a set of structured representations of messages coming from the same source, and determining in them a set of dynamic differences by making comparisons between the structured representations of this set,

a deducer, capable of comparing sets of structured representations of messages coming from different sources, and eliminating the differences shared with the sets of dynamic differences associated with these sources, in order to establish a set of static differences forming selective patterns.

4. Monitor according to claim 2, characterised in that a selective pattern comprises a set of values characteristic of a distinct source.

5. Monitor according to claim 2, characterised in that a selective pattern comprises a set of pathways in the structured representation.

6. Monitor according to claim 2, characterised in that the structured representation of a message is an n-ary tree.

7. Monitor according to claim 6, characterised in that the nodes of the tree are produced as a function of the set of rules.

8. Monitor according to claim 7, characterised in that at least some of the rules are based on the syntax of the messages of a communications protocol used by the messages.

9. Monitor according to claim 8, characterised in that at least some of the rules are based on the semantics of the communications protocol used by the messages.

10. Process for analysing message-based communications, comprising:

a) establishing selective patterns from distinct sources,

b) analysing a new message in order to associate it with one of the distinct sources, wherein step a. comprises;

a1) inspecting a plurality of messages in order to derive from them structured representations in correspondence with a set of rules,

a2) searching for selective source patterns, from the comparison of structured representations relating to a number of sources, and wherein step b) comprises;

b1) associating the new message with one of the sources by comparing the selective patterns with a signature derived from the structured representation associated with this new message.

11. Process according to claim 10, characterised in that step a2) comprises:

a21) comparing structured representation of messages coming from the same source, in order to derive from them a set of dynamic differences,

a22) repeating step a21) for at least one other source,

a23) comparing structured representation of messages coming from different sources, and

a24) eliminating the differences shared with the sets of dynamic differences associated with these sources in order to derive from them a set of static differences forming the selective patterns.