SYSTEMS AND METHODS FOR NETWORK DATA FLOW AGGREGATION

• US 20160205002A1
• Filed: 12/18/2015
• Published: 07/14/2016
• Est. Priority Date: 06/14/2013
• Status: Active Grant

• Current Assignee: Catbird Networks, Inc.
• Original Assignee: Catbird Networks, Inc.
• Inventors: Thorson, Shane Robert, Rieke, Malcolm, Dennis, James Sebastian
• Granted Patent: US 11,196,636 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments of the present disclosure can aggregate network flow data over various periods of time, and present a graphical representation of the network flow information based on the aggregated data instead of (or in addition to) the raw network flow data. Among other things, embodiments of the present disclosure are able to present historical network flow data for relatively long periods of time without having to store large volumes of raw network flow data.

Claims

1. A computer-implemented method comprising:

collecting, by a computer system, data from a plurality of different types of sources on a network;

identifying, by the computer system based the collected data, a plurality of network assets and connections between the plurality of network assets;

generating, by the computer system, an aggregation of the collected data that includes a subset of the collected data over a predetermined period of time; and

presenting, by the computer system based on the aggregation of the collected data, a graphical representation that includes the plurality of network assets and the connections between the plurality of network assets, wherein the graphical representation is presented via a display of a user interface in communication with the computer system.

2. The method of claim 1, wherein the subset of the collected data includes a unique identifier associated with a network asset from the plurality of network assets.

3. The method of claim 2, wherein the subset of the collected data includes a unique identifier associated with a source asset from the plurality of network assets from which network traffic originates and a unique identifier associated with a destination asset from the plurality of network assets to which network traffic is directed.

4. The method of claim 1, further comprising:

receiving a selection, via the user interface, of a flow policy associated with a particular type of network flow, wherein the flow policy is one of;

a policy to track network flow based on the subset of the collected data; and

a policy to track network flow based on both the subset of the collected data and the collected data in its entirety; and

generating the aggregation of the collected data based on the received flow policy.

5. The method of claim 4, further comprising receiving a selection, via the user interface, to configure the predetermined time period.

6. The method of claim 5, wherein generating the aggregation of the collected data includes:

generating a first aggregation of collected data for a first period of time; and

generating a second aggregation of collected data for a second period of time, wherein the second period of time is longer than the first period of time and the second aggregation of collected data includes a subset of the first aggregation of collected data.

7. The method of claim 6, wherein generating the second aggregation of collected data includes updating one or more of the following in the second aggregation of network flows based on the first aggregation of collected data:

a count of network flows between assets on the network, and a number of bytes transmitted between assets on the network.

8. The method of claim 6, wherein generating the second aggregation of collected data includes a subset of collected data from each of a plurality of aggregations of collected data for a respective plurality of time periods, and wherein each of the respective plurality of time periods is shorter than the second period of time.

9. The method of claim 8, wherein each of the plurality of time periods is of equal length.

10. The method of claim 8, wherein at least two of the plurality of time periods are of different length.

11. The method of claim 1, wherein the plurality of network assets include a host network asset and a client network asset, and wherein presenting the graphical representation includes presenting a flow information graph that depicts the host network asset, the client network asset, connections between the host network asset and the client network asset, services that are permitted to be accessed between the host network asset and the client network asset, and services that are not permitted to be accessed between the host network asset and the client network asset.

12. The method of claim 11, wherein the flow information graph visually indicates one or more of:

an attribute of the host network asset, an attribute of the client network asset, and an attribute of a connection between the host network asset and the client network asset.

13. The method of claim 11, wherein the flow information graph depicts connections between the host network asset and the client network asset using selectable directional flow lines.

14. The method of claim 11, wherein the flow lines indicate a type of the source of the collected data used to identify the connection.

15. The method of claim 11, wherein presenting the flow information graph includes:

identifying a security vulnerability associated with one or more of the host network asset and the client network asset; and

visually indicating the identified security vulnerability in the flow information graph.

16. The method of claim 1, wherein the collected data is obtained from a source selected from the group consisting of:

a NETFLOW IPFIX collector, a network tap, a router, a switch, a firewall, an intrusion detection system, an intrusion protection system, and combinations thereof.

17. The method of claim 1, further comprising:

analyzing the collected data; and

generating an alert in response to the analysis of the collected data.

18. The method of claim 17, wherein analyzing the collected data includes comparing the collected data to one or more of:

a security policy, a standards compliance policy, and a performance standard.

19. A tangible, non-transitory computer-readable medium storing instructions that, when executed, cause a computer system to:

collect data from a plurality of different types of sources on a network;

identify, based the collected data, a plurality of network assets and connections between the plurality of network assets;

generate an aggregation of the collected data that includes a subset of the collected data over a predetermined period of time; and

presenting, by the computer system based on the aggregation of the collected data, a graphical representation that includes the plurality of network assets and the connections between the plurality of network assets, wherein the graphical representation is presented via a display of a user interface in communication with the computer system.

20. A computer system comprising:

a processor; and

memory in communication with the processor and storing instructions that, when executed by the processor, cause the computer system to;

collect data from a plurality of different types of sources on a network;

identify, based the collected data, a plurality of network assets and connections between the plurality of network assets;

generate an aggregation of the collected data that includes a subset of the collected data over a predetermined period of time; and

presenting, by the computer system based on the aggregation of the collected data, a graphical representation that includes the plurality of network assets and the connections between the plurality of network assets, wherein the graphical representation is presented via a display of a user interface in communication with the computer system.