US6735702B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for diagnosing network intrusion
Assignee: Beijing Xiaomi Mobile Software Co Ltd
•
Filing: 1999-08-31
•
Granted: 2004-05-11
•
Expires: 2019-08-31
Abstract
Abstract A method and system are disclosed for analyzing traffic on a network by monitoring network traffic and, when a particular network condition (for example, a network attack) is detected, gathering information about the traffic on the network by launching an agent and having the agent iteratively identify which of the links on the node on which the agent operates accepts a type or class of traffic, traverse the identified link to the node across the link, and repeat the process.
Inventors
- 👤 Rajenda Yavatkar
- 👤 David M. Putzolu
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 13:21
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1441; H04L63/1466; G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/554; H04L63/1408; H04L63/1416
Claims Analysis
Total Claims: 29
Claim 1
Independent Claim
81 words
A method for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the method comprising: at at least a first node on the network monitoring traffic; and if a particular network condition is detected, gathering information about the traffic on the network using an agent which: identifies which of the links on the node on which the agent operates accepts a class of traffic; and traverses the link to the node across the link.
Claim 2
Independent Claim
81 words
A method for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the method comprising: at at least a first node on the network monitoring traffic; and if a particular network condition is detected, gathering information about the traffic on the network using an agent which: identifies which of the links on the node on which the agent operates accepts a class of traffic; and traverses the link to the node across the link.
Claim 3
Dependent Claim
13 words
The method of claim 1 where the agent repeatedly identifies and traverses links.
Claim 4
Dependent Claim
13 words
The method of claim 2 where the network condition is an attack condition.
Claim 5
Dependent Claim
18 words
The method of claim 3 where the class of traffic is traffic having identifying characteristics of an attack.
Claim 6
Dependent Claim
24 words
The method of claim 4 where the agent, after identifying a link, records the node on which the agent operates and the identified link.
Claim 7
Dependent Claim
16 words
The method of claim 2 where the class of traffic is traffic including node attack traffic.
Claim 8
Dependent Claim
17 words
The method of claim 2 where the class of traffic is traffic including unauthorized access attack traffic.
Claim 9
Dependent Claim
18 words
The method of claim 2 where the class of traffic is traffic including denial of service attack traffic.
Claim 10
Dependent Claim
14 words
The method of claim 1 further including: launching the agent from a second node.
Claim 11
Dependent Claim
26 words
The method of claim 1 where the node on which the agent initially operates is topologically near a node identified as being subject to the attack.
Claim 12
Independent Claim
139 words
A method for analyzing a network, the network comprising nodes, each node connecting to a set of links, the method comprising: at at least a first node on the network monitoring for an attack condition; and at the first node, when an attack condition is detected, determining a set of traffic suspected to be attack traffic and launching an agent, the agent recording information about traffic by: detecting which among the links of the node at which the agent currently operates is receiving the most of a subset of the set of traffic suspected to be attack traffic; selecting a link found to be receiving the most of the subset of the set of traffic suspected to be attack traffic and recording the identity of the selected link; and attempting to move to the node connected to the selected.
Claim 13
Independent Claim
139 words
A method for analyzing a network, the network comprising nodes, each node connecting to a set of links, the method comprising: at at least a first node on the network monitoring for an attack condition; and at the first node, when an attack condition is detected, determining a set of traffic suspected to be attack traffic and launching an agent, the agent recording information about traffic by: detecting which among the links of the node at which the agent currently operates is receiving the most of a subset of the set of traffic suspected to be attack traffic; selecting a link found to be receiving the most of the subset of the set of traffic suspected to be attack traffic and recording the identity of the selected link; and attempting to move to the node connected to the selected.
Claim 14
Dependent Claim
29 words
The method of claim 11 where the agent repeats detecting, selecting and attempting to move until the agent fails to perform one of detecting, selecting and attempting to move.
Claim 15
Dependent Claim
47 words
The method of claim 12 further including: recording a set of samples of traffic receive at a node in the network; determining, from the set of samples, the type of attack which is occurring; and tailoring the agent to follow traffic based on the type of attack.
Claim 16
Dependent Claim
19 words
The method of claim 12 where the agent provides a report to a process executing on the first node.
Claim 17
Dependent Claim
22 words
The method of claim 12 where the information about the traffic includes at least a set of paths taken by the traffic.
Claim 18
Dependent Claim
17 words
The method of claim 12 where monitoring for an attack condition is performed by a monitoring agent.
Claim 19
Dependent Claim
52 words
The method of claim 12 where the agent detects which among the links of the node at which the agent currently operates is receiving the most of the set of traffic suspected to be attack traffic by determining which of the links is receiving the most of a certain type of traffic.
Claim 20
Independent Claim
79 words
A system for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the system comprising: an agent of to: identify which of the links on the node on which the agent operates accepts attack traffic; and traverse the link to the node across the link; and a module to monitor network traffic, and, when if an attack condition is detected, to gather information about traffic on the network by launching the agent.
Claim 21
Independent Claim
79 words
A system for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the system comprising: an agent of to: identify which of the links on the node on which the agent operates accepts attack traffic; and traverse the link to the node across the link; and a module to monitor network traffic, and, when if an attack condition is detected, to gather information about traffic on the network by launching the agent.
Claim 22
Dependent Claim
17 words
The system of claim 18 where the attack traffic is identified by filtering for node attack packets.
Claim 23
Dependent Claim
18 words
The system of claim 18 where the attack traffic is identified by filtering for unauthorized access attack packets.
Claim 24
Dependent Claim
19 words
The system of claim 18 where the attack traffic is identified by filtering for denial of service attack packets.
Claim 25
Dependent Claim
103 words
A set of instructions residing in a storage medium, said set of instructions capable of being executed by a processor to implement a method for analyzing attack traffic a network, the network comprising nodes, each node connecting to a set of links, the method comprising: monitoring traffic at at least a first node on the network; and if an attack condition is detected, gathering information about the traffic on the network by having an agent repeatedly: identify which of the links on the node on which the agent operates accepts attack traffic; and traversing traverse the link to the node across the link.
Claim 26
Dependent Claim
103 words
A set of instructions residing in a storage medium, said set of instructions capable of being executed by a processor to implement a method for analyzing attack traffic a network, the network comprising nodes, each node connecting to a set of links, the method comprising: monitoring traffic at at least a first node on the network; and if an attack condition is detected, gathering information about the traffic on the network by having an agent repeatedly: identify which of the links on the node on which the agent operates accepts attack traffic; and traversing traverse the link to the node across the link.
Claim 27
Dependent Claim
19 words
The set of instructions of claim 22 where the attack traffic is identified by filtering for node attack packets.
Claim 28
Dependent Claim
20 words
The set of instructions of claim 22 where the attack traffic is identified by filtering for unauthorized access attack packets.
Claim 29
Dependent Claim
21 words
The set of instructions of claim 22 where the attack traffic is identified by filtering for denial of service attack packets.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-05-11 | 2007-11-10 | 2008-05-11 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-05-11 | 2011-11-10 | 2012-05-11 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-05-11 | 2015-11-10 | 2016-05-11 | $7700.00 | Window Closed / Lapsed |