Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof

• US 9,270,766 B2
• Filed: 12/30/2011
• Issued: 02/23/2016
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Rovniaguin, Dmitry, Dan, Ephraim, Talmor, Ron
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): Zhu, Zhimei
• Application Number:
  US13/341,360
• Publication Number:
  US 20130173779A1
• Time in Patent Office: 1,516 Days
• Field of Search: 370/235, 707/999.01, 709223-225, 726/22, 726/23
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A method, non-transitory computer readable medium, and device that identifies network traffic characteristics to correlate and manage one or more subsequent flows includes transmitting a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request. The HTTP request is transmitted to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server. An HTTP response to the HTTP request is received from the application server. An operation with respect to the HTTP response is performed.

Claims

1. A method for identifying network traffic characteristics to correlate and manage one or more subsequent flows executable by one or more traffic management devices with at least one processor for executing the method, the method comprising:

transmitting, by a processor on the one or more traffic management devices, a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmitting, by the processor on the one or more traffic management devices, the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receiving, by the processor on the one or more traffic management devices, an HTTP response to the HTTP request from the application server;

transmitting, by the processor on the one or more traffic management devices, a monitoring response message to end the correlation associated with the HTTP request; and

performing, by the processor on the one or more traffic management devices, at least one operation with respect to the HTTP response when a command message in a response to the monitoring response message is not received before a predetermined period of time elapses.

2. The method of claim 1 wherein the performing further comprises:

outputting, by the processor on the one or more traffic management devices, the HTTP response to the requesting client computing device.

3. The method of claim 1 further comprising:

receiving, by the processor on the one or more traffic management devices, a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing, by the traffic management computing device, the determined action on the HTTP response.

4. The method of claim 3 wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, and terminating, by the traffic management computing device, the output of the HTTP response to the requesting client computing device.

5. The method of claim 1 wherein the one or more attributes comprise a client identification and a session identification in the HTTP request.

6. The method of claim 5 wherein the one or more attributes further comprise one or more request values.

7. A non-transitory computer readable medium having stored thereon instructions for identifying network traffic characteristics to correlate and manage one or more subsequent flows comprising machine executable code which when executed by at least one processor, causes the processor to perform steps comprising:

transmitting a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmitting the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receiving an HTTP response to the HTTP request from the application server;

transmitting a monitoring response message to end the correlation associated with the HTTP request; and

performing at least one operation with respect to the HTTP response when a command message in a response to the monitoring response message is not received before a predetermined period of time elapses.

8. The medium of claim 7 wherein the performing further comprises outputting the HTTP response to the requesting client computing device.

9. The medium of claim 7 further comprising receiving a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing the determined action on the HTTP response.

10. The medium of claim 9 wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, and terminating the output of the HTTP response to the requesting client computing device.

11. The medium of claim 7 wherein the one or more attributes comprise a client identification and a session identification in the HTTP request.

12. The medium of claim 11 wherein the one or more attributes further comprise one or more request values.

13. One or more traffic management computing devices comprising:

one or more processors;

a memory coupled to the one or more processors which are configured to be capable of executing programmed instructions, which comprise the programmed instructions stored in the memory to;

transmit a monitoring request comprising one or more attributes extracted from an HTTP request received from a client computing device and a timestamp to a monitoring server to correlate one or more subsequent flows associated with the HTTP request;

transmit the HTTP request to an application server after receiving an acknowledgement response to the monitoring request from the monitoring server;

receive an HTTP response to the HTTP request from the application server;

transmit a monitoring response message to end the correlation associated with the HTTP request; and

perform at least on operation with respect to the HTTP response when a command message in response to the monitoring response message is not received before a predetermined period of time elapses.

14. The device of claim 13 wherein the performing further comprises outputting the HTTP response to the requesting client computing device.

15. The device of claim 13 wherein the one or more processors is further configured to execute programmed instructions stored in the memory further comprising receiving a determined action with respect to the HTTP request from the monitoring server which is based on at least one data access policy, wherein the performing further comprises executing the determined action on the HTTP response.

16. The device of claim 15 wherein the determined action comprises one or more of allowing, logging, reporting, quarantining, or terminating the output of the HTTP response to the requesting client computing device.

17. The device of claim 13 wherein the one or more attributes comprise a client identification and a session identification in the HTTP request.

18. The device of claim 17 wherein the one or more attributes further comprise one or more request values.