Server resource management, analysis, and intrusion negation

• US 7,353,538 B2
• Filed: 11/08/2002
• Issued: 04/01/2008
• Est. Priority Date: 11/08/2002
• Status: Expired due to Term

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Federal Network Systems LLC (Jacobs Solutions, Inc.)
• Inventors: Sample, Char
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Simitoski; Michael J
• Application Number:
  US10/290,961
• Publication Number:
  US 20040093512A1
• Time in Patent Office: 1,971 Days
• Field of Search: 709/219, 709/224, 709/229, 709/233, 709/235, 709/226, 713/151, 713/201, 713/165, 713/166, 713/167, 714/47, 726/23, 726/24, 726/25, 726/1, 718/105, 716/164
• US Class Current: 726/23
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A console host and intrusion negation system (CHAINS) includes a host component [202] and a console component [203]. The host component [202] monitors resources at a server [501-503]. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Claims

1. A method for managing resources, comprising:

monitoring a plurality of resources associated with a network server, the plurality of resources including at least an activity level at a communication interface of the network server and an activity level corresponding to memory usage of the network server;

comparing activity levels of the plurality of resources to predetermined threshold activity levels; and

in response to the comparing,

reducing usage of one of the plurality of resources when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level associated therewith, reducing usage including reducing the activity level at the communication interface of the network server when the respective activity level increases above the predetermined threshold activity level associated therewith, and including shutting down inactive processes to thereby reduce memory usage of the network server when the memory usage increases above the predetermined threshold activity level associated therewith.

2. The method of claim 1, wherein determining an activity level at the communication interface includes keeping track of a number of open network connections.

3. The method of claim 1, wherein monitoring a plurality of resources further includes:

determining usage of a processor of the network server.

4. The method of claim 3, wherein monitoring a plurality of resources further includes:

determining capacity of a hard disk drive associated with the network server.

5. The method of claim 1, further comprising:

alerting a user when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level.

6. The method of claim 5, wherein alerting the user includes transmitting an alert to a remote computer.

7. The method of claim 1, wherein the predetermined threshold activity levels are set by a user from a remote computer.

8. A computer server comprising:

at least one processor;

a communication interface; and

a memory containing instructions that when executed by the at least one processor cause the processor to;

monitor a usage level of the communication interface, the memory, and at least one of the at least one processor;

compare the usage level of the communication interface to a first threshold and reduce a number of active network connections when the usage level of the communication interface is greater than the first threshold;

compare the usage level of the memory to a second threshold and shut down inactive processes when the usage level of the memory is above the second threshold; and

compare the usage level of the monitored processor to a third threshold and shut down inactive processes when the usage level of the monitored processor is above the third threshold.

9. The computer server of claim 8, further comprising:

a magnetic storage device, wherein

the memory contains additional instructions that when executed by the processor cause the processor to;

compare a usage level of the magnetic storage device to a fourth threshold and compress files on the magnetic storage device when the usage level of the magnetic storage device is above the fourth threshold.

10. The computer server of claim 8, wherein the first, second, and third thresholds are set remotely.

11. The computer server of claim 8, wherein the memory contains additional instructions that when executed by the processor cause the processor to transmit a resource alert to a remote computer.

12. A system comprising:

a plurality of first computing devices, each of the plurality of first computing devices including a corresponding host software component configured to monitor resources of the corresponding first computing device, the resources including at least a usage level of a communication interface, computer random access memory, and a processor, the host software component reducing resource usage, including reducing the usage level of the communication interface, computer random access memory or processor, when, in response to the monitoring, resources of the corresponding first computing device are being used above respective predetermined threshold levels, the host software component reducing the usage level of computer random access memory including the host software component shutting down inactive processes when the respective usage level increases above a threshold level thereof; and

a second computing device including a console software component configured to display alerts when any one or more of the resources of the first computing device are being used above the predetermined threshold levels.

13. The system of claim 12, wherein when the second computing device receives alerts from multiple ones of the first computing devices, the second computing device outputs information describing a possible denial of service attack.

14. The system of claim 12, wherein the second computing device transmits the predetermined threshold levels to the first computing device.

15. The system of claim 12, wherein the second computing device is located remotely from the first computing device.

16. The system of claim 12, wherein the first computing devices are network servers.

17. A computer-readable medium containing instructions that when executed by a processor cause the processor to:

monitor a plurality of resources associated with a network server, the monitored plurality of resources including at least an activity level at a communication interface of the network server and an activity level corresponding to memory usage of the network server;

compare activity levels of the plurality of resources to predetermined threshold activity levels; and

in response to the comparing,

reduce usage of one of the plurality of resources when the activity level associated with the one of the plurality of resources increases above the predetermined threshold activity level associated with the one of the plurality of resources, reducing usage including reducing the activity level at the communication interface of the network server when the respective activity level increases above the predetermined threshold activity level associated therewith, and including shutting down inactive processes to thereby reduce memory usage of the network server when the memory usage increases above the predetermined threshold activity level associated therewith.

18. The computer-readable medium of claim 17, further comprising instructions that when executed by the processor cause the processor to:

alert a user when usage of the one of the plurality of resources increases above the predetermined threshold activity level.

19. The computer-readable medium of claim 17, wherein the predetermined threshold activity levels are set by a user from a remote computer.

20. A computer-readable medium of claim 17, wherein the predetermined threshold activity levels are set by a user from a remote computer.

21. A method for managing resources comprising:

displaying information relating to resources of a plurality of remote computers;

receiving information defining threshold levels for the resources at the plurality of remote computers; and

transmitting the information defining the threshold levels for the resources to the plurality of remote computers such that the remote computers monitor a resource usage level thereof, wherein

the remote computers reduce resource usage when, in response to monitoring the resource usage level of the resources, the resource usage level exceeds the threshold levels, and wherein the remote computers shut down inactive processes to thereby reduce memory usage when the memory usage increases above a threshold level thereof.

22. The method of claim 21, wherein when the resource usage level of multiple ones of the remote computers exceeds the threshold level, outputting information describing a possible attack.

23. The method of claim 21, wherein the remote computers are network servers.

24. The method of claim 21, wherein the resources of the remote computers include at least one of a communication interface, a processor, a disk drive, or computer random access memory.

25. A device comprising:

means for displaying information relating to resources of a plurality of remote computers;

means for receiving information defining threshold levels for the resources at the plurality of remote computers; and

means for transmitting the information defining the threshold levels for the resources at the plurality of remote computers such that the remote computers monitor a resource usage level thereof, wherein

the remote computers reduce resource usage when a resource usage level exceeds the threshold levels, and wherein the remote computers shut down inactive processes to thereby reduce memory usage when the memory usage increases above a threshold level thereof.