US7120931B1 — System and method for generating filters based on…

Claim 1

Independent Claim 140 words

A method for generating filters based on data entering a network device, comprising: separating the data into a plurality of network flows; creating separate aggregate network flow summaries for each of said network flows; sending at least one of said aggregate network flow summaries to a flow analyzer at the network device; analyzing said at least one aggregate network flow summary to detect characteristics of potentially harmful network flows; generating or refining a filter based on said analyzed aggregate network flow summary to prevent packets corresponding to detected potentially harmful network flows from passing through said network device; and selecting a new aggregate network flow summary to analyze and sending the selected aggregate network flow summary to the flow analyzer for analysis, wherein the new aggregate flow summary corresponds to a network flow associated with the generated or refined filter.

Claim 2

Independent Claim 140 words

A method for generating filters based on data entering a network device, comprising: separating the data into a plurality of network flows; creating separate aggregate network flow summaries for each of said network flows; sending at least one of said aggregate network flow summaries to a flow analyzer at the network device; analyzing said at least one aggregate network flow summary to detect characteristics of potentially harmful network flows; generating or refining a filter based on said analyzed aggregate network flow summary to prevent packets corresponding to detected potentially harmful network flows from passing through said network device; and selecting a new aggregate network flow summary to analyze and sending the selected aggregate network flow summary to the flow analyzer for analysis, wherein the new aggregate flow summary corresponds to a network flow associated with the generated or refined filter.

Claim 3

Dependent Claim 18 words

The method of claim 1 further comprising classifying network flow based on a source device sending a packet.

Claim 4

Dependent Claim 20 words

The method of claim 2 wherein the network flow is classified based on an IP address of the source device.

Claim 5

Dependent Claim 23 words

The method of claim 1 wherein analyzing said at least one aggregate network flow summary comprises monitoring statistics associated with said network flows.

Claim 6

Dependent Claim 16 words

The method of claim 1 further comprising propagating the generated filter to an upstream network device.

Claim 7

Dependent Claim 30 words

The method of claim 1 further comprising sending each of said plurality of network flows to a corresponding flow cache and implementing policies designated for each of said network flows.

Claim 8

Dependent Claim 32 words

The method of claim 6 wherein sending each of said plurality of network flows is performed by hardware and analyzing said at least one aggregate network flow summary is performed by software.

Claim 9

Dependent Claim 18 words

The method of claim 1 wherein analyzing said at least one aggregate network flow summary comprises utilizing software.

Claim 10

Dependent Claim 31 words

The method of claim 1 wherein selecting a new aggregate network flow summary to analyze comprises selecting a class of said network flows to analyze based on previously analyzed network flows.

Claim 11

Dependent Claim 43 words

The method of claim 1 wherein detecting potentially harmful network flows comprises identifying a source address associated with said harmful network flow and generating a filter comprises generating a filter to prevent packets from said identified source from passing through said network device.

Claim 12

Dependent Claim 32 words

The method of claim 1 wherein information resulting from analyzing at least one of said aggregate network flow summaries is reduced in hardware so that flow records can be analyzed by software.

Claim 13

Dependent Claim 27 words

The method of claim 1 wherein a group of potentially harmful packets is detected and further comprising analyzing said corresponding network flow and further refining said filter.

Claim 14

Dependent Claim 16 words

The method of claim 1 further comprising selecting a group of network flows to be analyzed.

Claim 15

Dependent Claim 19 words

The method of claim 13 further comprising passing information on the selected group of network flows to a classifier.

Claim 16

Dependent Claim 25 words

The method of claim 1 wherein a class of packets to be analyzed is selected based on statistics associated with the generated or refined filter.

Claim 17

Dependent Claim 22 words

The method of claim 1 further comprising splitting said filters if traffic into said filter exceeds a sampling capability of the filter.

Claim 18

Dependent Claim 20 words

The method of claim 1 wherein analyzing said aggregate network flow summary comprises analyzing for a specified interval of time.

Claim 19

Dependent Claim 154 words

A computer program product for generating filters based on analyzed network flows, comprising: code that separates data into different network flows; code that creates an aggregate network flow summary for one or more of said network flows; code that selects one or more network flows for analysis; code that sends said selected aggregate network flow summaries to a flow analyzer at the network device; code that analyzes said selected network flows by reviewing said aggregate network flow summaries; code that detects potentially harmful network flows; code that automatically generates or refines a filter based on said analyzed network flow summary to prevent packets corresponding to said detected potentially harmful network flows from passing through the network device; code that selects a new aggregate network flow summary to analyze and send the selected aggregate network flow summary to the flow analyzer for analysis; and a computer-readable storage for storing the codes executable by a processor.

Claim 20

Dependent Claim 154 words

A computer program product for generating filters based on analyzed network flows, comprising: code that separates data into different network flows; code that creates an aggregate network flow summary for one or more of said network flows; code that selects one or more network flows for analysis; code that sends said selected aggregate network flow summaries to a flow analyzer at the network device; code that analyzes said selected network flows by reviewing said aggregate network flow summaries; code that detects potentially harmful network flows; code that automatically generates or refines a filter based on said analyzed network flow summary to prevent packets corresponding to said detected potentially harmful network flows from passing through the network device; code that selects a new aggregate network flow summary to analyze and send the selected aggregate network flow summary to the flow analyzer for analysis; and a computer-readable storage for storing the codes executable by a processor.

Claim 21

Dependent Claim 19 words

The computer program product of claim 18 further comprising code that propagates said filter to an upstream network device.

Claim 22

Dependent Claim 20 words

The computer program product of claim 18 further comprising code that refines said filter based on said analyzed network flow.

Claim 23

Independent Claim 127 words

A system for automatically generating filters based on data entering a network device, comprising: a netflow device operable to receive streams of packets, separate said streams, and create a summary record containing information on each of said streams; a flow analyzer located at the network device and operable to receive said summary records from said netflow device and analyze said summary records and identify potentially harmful network flows; and a filter generator operable to generate or refine a filter based on analyzed summary records to prevent packets corresponding to said identified potentially harmful network flows from passing through the network device, wherein said netflow device is operable to create a new summary record containing information on a stream of data associated with said generated or refined filter.

Claim 24

Independent Claim 127 words

A system for automatically generating filters based on data entering a network device, comprising: a netflow device operable to receive streams of packets, separate said streams, and create a summary record containing information on each of said streams; a flow analyzer located at the network device and operable to receive said summary records from said netflow device and analyze said summary records and identify potentially harmful network flows; and a filter generator operable to generate or refine a filter based on analyzed summary records to prevent packets corresponding to said identified potentially harmful network flows from passing through the network device, wherein said netflow device is operable to create a new summary record containing information on a stream of data associated with said generated or refined filter.

Claim 25

Dependent Claim 20 words

The system of claim 21 wherein the network device comprises hardware and the flow analyzer and filter generator comprise software.

Claim 26

Dependent Claim 22 words

The system of claim 21 wherein the network device comprises an ACL classifier, a lookup device, and a plurality of flow buckets.

Claim 27

Dependent Claim 31 words

The system of claim 21 further comprising a filter propagator operable to send information on said filters to an upstream device and request the upstream device to create a corresponding filter.

Claim 28

Dependent Claim 34 words

The system of claim 21 further comprising a netflow directory comprising a plurality of flow cache entries and configured to build new flow cache entries for network flows without a corresponding flow cache entry.

Claim 29

Dependent Claim 27 words

The system of claim 21 further comprising a classifier operable to classify said streams of packets based on one or more packets received at the netflow device.

Claim 30

Independent Claim 96 words

A method for generating filters for network flow, comprising: receiving data at a network device; classifying network flows based on one or more packets received at the network device; analyzing one or more of said network flows; generating a filter for one or more of said network flows; processing each of said network flows according to a corresponding policy; selecting a class of network flows to analyze; analyzing said selected class of network flows; and refining said filter for said selected class of network flows, wherein refining said filter comprises modifying the classification of network flows.

Claim 31

Independent Claim 96 words

A method for generating filters for network flow, comprising: receiving data at a network device; classifying network flows based on one or more packets received at the network device; analyzing one or more of said network flows; generating a filter for one or more of said network flows; processing each of said network flows according to a corresponding policy; selecting a class of network flows to analyze; analyzing said selected class of network flows; and refining said filter for said selected class of network flows, wherein refining said filter comprises modifying the classification of network flows.

Claim 32

Dependent Claim 18 words

The method of claim 27 wherein each of said filters are generated specifically for a corresponding network flow.

Claim 33

Independent Claim 163 words

An apparatus for generating filters based on analyzed network flows, the apparatus comprising: one or more processors; and a memory that stores instructions to be executed by said one or more processors, said instructions comprising: code that creates separate aggregate network flow summaries for each of said network flows; code that sends at least one of said aggregate network flow summaries to a flow analyzer at the network device; code that analyzes said at least one aggregate network flow summary to detect characteristics of potentially harmful network flows; code that generates or refines a filter based on said analyzed aggregate network flow summary to prevent packets corresponding to detected potentially harmful network flows from passing through said network device; and code that selects a new aggregate network flow summary to analyze and sending the selected aggregate network flow summary to the flow analyzer for analysis, wherein the new aggregate flow summary corresponds to a network flow associated with the generated or refined filter.

Claim 34

Independent Claim 163 words

An apparatus for generating filters based on analyzed network flows, the apparatus comprising: one or more processors; and a memory that stores instructions to be executed by said one or more processors, said instructions comprising: code that creates separate aggregate network flow summaries for each of said network flows; code that sends at least one of said aggregate network flow summaries to a flow analyzer at the network device; code that analyzes said at least one aggregate network flow summary to detect characteristics of potentially harmful network flows; code that generates or refines a filter based on said analyzed aggregate network flow summary to prevent packets corresponding to detected potentially harmful network flows from passing through said network device; and code that selects a new aggregate network flow summary to analyze and sending the selected aggregate network flow summary to the flow analyzer for analysis, wherein the new aggregate flow summary corresponds to a network flow associated with the generated or refined filter.

Claim 35

Dependent Claim 20 words

The apparatus of claim 29 wherein said instructions further comprise code that propagates said filter to an upstream network device.

Claim 36

Dependent Claim 23 words

The apparatus of claim 29 wherein said instructions further comprise code that classifies network flow based on a source device sending a packet.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2009-10-09	2010-04-10	2010-10-10	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2013-10-09	2014-04-10	2014-10-10	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2017-10-09	2018-04-10	2018-10-10	$7700.00	Window Closed / Lapsed

System and method for generating filters based on analyzed flow data

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag