AUTOMATIC TARGET SELECTION

• US 20160226726A1
• Filed: 01/30/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Original Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Inventors: RAO, Anil
• Granted Patent: US 9,674,053 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of identifying targets for monitoring includes: obtaining a user-defined filter map, the user-defined filter map having one or more filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic. and determining a set of one or more targets by a processing unit based at least in part on the user-defined filter map, wherein the processing unit comprises a target selection module configured to access a list of available targets from a database, and select the one or more targets from the list of available targets based at least in part on the user-defined filter map.

Claims

1. A method of identifying targets for monitoring, comprising:

obtaining a user-defined filter map, the user-defined filter map having one or more filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic; and

determining a set of one or more targets by a processing unit based at least in part on the user-defined filter map, wherein the processing unit comprises a target selection module configured to access a list of available targets from a database, and select the one or more targets from the list of available targets based at least in part on the user-defined filter map.

2. The method of claim 1, wherein the target selection module is configured to select the one or more targets from the list of available targets based on:

3. The method of claim 2, wherein the target selection module is configured to select the one or more targets from the list of available targets also based on an inclusion set I defined as:

4. The method of claim 3, wherein the target selection module is configured to select the one or more targets from the list of available targets also based on an exclusion set E defined as:

5. The method of claim 4, wherein the one or more targets constitute a target set T defined as T=(F∩

I)−

E.

6. The method of claim 1, wherein the targets comprise a virtual machine (VM).

7. The method of claim 1, wherein the targets comprise a vNIC.

8. The method of claim 1, wherein the act of determining the set of one or more targets comprises determining a first set of targets that are possible source(s) and/or recipient(s) of packets satisfying any of the one or more filter rules in the user-defined filter map.

9. The method of claim 1, wherein the user-defined filter map comprises a first filter rule having first multiple filter components, and wherein the act of determining the set of one or more targets comprises determining a first set of targets by the processing unit that are possible source(s) and/or recipient(s) of packets satisfying all of the first multiple filter components of the first filter rule.

10. The method of claim 9, wherein the user-defined filter map comprises a second filter rule having second multiple filter components, and wherein the act of determining the set of one or more targets further comprises determining a second set of targets by the processing unit that are possible source(s) and/or recipient(s) of packets satisfying all of the second multiple filter components of the second filter rule.

11. The method of claim 8, further comprising:

obtaining information regarding an inclusion set; and

determining a second set of targets based on the information regarding the inclusion set;

wherein the set of one or more targets is determined based on;

(the first set of targets)∩

(the second set of targets).

12. The method of claim 11, further comprising:

obtaining information regarding an exclusion set; and

determining a third set of targets based on the information regarding the exclusion set;

wherein the set of one or more targets is determined based on;

((the first set of targets)∩

(the second set of targets))−

(the third set of targets).

13. The method of claim 1, wherein the obtained user-defined filter map comprises a newly created filter rule, and the act of determining the set of one or more targets is performed by the processing unit in response to the newly created filter rule.

14. The method of claim 1, wherein the obtained user-defined filter map comprises a modified filter rule resulted from a modification of an existing filter rule, and the act of determining the set of one or more targets is performed by the processing unit in response to the modified filter rule.

15. The method of claim 1, wherein one of the one or more filter rules comprises one or more filter components, the one or more filter components comprising information regarding a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, a wildcard, or any combination of the foregoing.

16. An apparatus for identifying targets for monitoring, comprising:

a non-transitory medium for storing a user-defined filter map, the user-defined filter map having one or more filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic; and

a processing unit configured for determining a set of one or more targets based at least in part on the user-defined filter map;

wherein the processing unit comprises a target selection module configured to determine the set of one or more targets by accessing a list of available targets from a database, and selecting the one or more targets from the list of available targets based at least in part on the user-defined filter map.

17. The apparatus of claim 16, wherein the target selection module is configured to select the one or more targets from the list of available targets based on:

18. The apparatus of claim 17, wherein the target selection module is configured to select the one or more targets from the list of available targets also based on an inclusion set I defined as:

19. The apparatus of claim 18, wherein the target selection module is configured to select the one or more targets from the list of available targets also based on an exclusion set E defined as:

20. The apparatus of claim 19, wherein the one or more targets constitute a target set T defined as T=(F∩

I)−

E.

21. The apparatus of claim 16, wherein the targets comprise a virtual machine (VM).

22. The apparatus of claim 16, wherein the targets comprise a vNIC.

23. The apparatus of claim 16, wherein the processing unit is configured for determining the set of one or more targets by determining a first set of targets that are possible source(s) and/or recipient(s) of packets satisfying any of the one or more filter rules in the user-defined filter map.

24. The apparatus of claim 16, wherein the user-defined filter map comprises a first filter rule having first multiple filter components, and wherein the processing unit is configured for determining the set of one or more targets by determining a first set of targets by the processing unit that are possible source(s) and/or recipient(s) of packets satisfying all of the first multiple filter components of the first filter rule.

25. The apparatus of claim 24, wherein the user-defined filter map comprises a second filter rule having second multiple filter components, and wherein the processing unit is configured for determining the set of one or more targets further by determining a second set of targets by the processing unit that are possible source(s) and/or recipient(s) of packets satisfying all of the second multiple filter components of the second filter rule.

26. The apparatus of claim 23, wherein the processing unit is further configured for:

obtaining information regarding an inclusion set; and

determining a second set of targets based on the information regarding the inclusion set;

wherein the processing unit is configured to determine the set of one or more targets based on;

(the first set of targets)∩

(the second set of targets).

27. The apparatus of claim 26, wherein the processing unit is further configured for:

obtaining information regarding an exclusion set; and

determining a third set of targets based on the information regarding the exclusion set;

wherein the processing unit is configured to determine the set of one or more targets based on;

((the first set of targets)∩

(the second set of targets))−

(the third set of targets).

28. The apparatus of claim 16, wherein the obtained user-defined filter map comprises a newly created filter rule, and the processing unit is configure for determining the set of one or more targets in response to the newly created filter rule.

29. The apparatus of claim 16, wherein the obtained user-defined filter map comprises a modified filter rule resulted from a modification of an existing filter rule, and the processing unit is configured for determining the set of one or more targets in response to the modified filter rule.

30. The apparatus of claim 16, wherein one of the one or more filter rules comprises one or more filter components, the one or more filter components comprising information regarding a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, a wildcard, or any combination of the foregoing.

31. An apparatus having a non-transitory medium storing a set of instructions, an execution of which by a processing unit causes a method of identifying targets for monitoring to be performed, the method comprising:

obtaining a user-defined filter map, the user-defined filter map having one or more filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic; and

determining a set of one or more targets by the processing unit based at least in part on the user-defined filter map, wherein the processing unit comprises a target selection module configured to access a list of available targets from a database, and select the one or more targets from the list of available targets based at least in part on the user-defined filter map.