Patent US7296288B1 successfully refreshed from Google Patents.
US7296288B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Methods, apparatuses, and systems allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users
Assignee: CA Inc
•
Filing: 2002-11-15
•
Granted: 2007-11-13
•
Expires: 2022-11-15
Abstract
Abstract Methods, apparatuses and systems allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users. In one embodiment, the present invention allows network administrators to penalize users who carry out specific questionable or suspicious activities, such as the use of proxy tunnels to disguise the true nature of the data flows in order to evade classification and control by bandwidth management devices. In one embodiment, each individual user may be accorded an initial suspicion score. Each time the user is associated with a questionable or suspicious activity (for example, detecting the set up of a connection to an outside HTTP tunnel, or peer-to-peer application flow), his or her suspicion score is downgraded. Data flows corresponding to users with sufficiently low suspicion scores, in one embodiment, can be treated in a different manner from data flows associated with other users. For example, different or more rigorous classification rules and policies can be applied to the data flows associated with suspicious users.
Inventors
- 👤 Mark Hill
- 👤 Guy Riddle
- 👤 Robert E. Purvy
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 02:48
CPC Classifications
H; H04; H04L; H04L41/00; H04L41/08; H04L41/0896; H04L43/00; H04L43/08; H04L43/0876; H04L43/0882; H04L43/16; H04L63/00; H04L63/14; H04L63/1408; H04L41/02; H04L41/0213
Claims Analysis
Total Claims: 38
Claim 1
Independent Claim
120 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; maintaining a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and applying bandwidth utilization controls to the data flows associated with the at least one user based on the respective suspicion level.
Claim 2
Independent Claim
120 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; maintaining a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and applying bandwidth utilization controls to the data flows associated with the at least one user based on the respective suspicion level.
Claim 3
Dependent Claim
67 words
The method of claim 1 wherein at least one of the indications of suspicious activity comprises a user connecting to a tunnel proxy resource further comprising the step of conditionally applying a decay rate to the suspicion level, wherein the decay rate results in the lowering of the suspicion level for the user if no detected indications of suspicious activity occur during a pre-defined number of periods.
Claim 4
Dependent Claim
20 words
The method of claim 1 wherein at least one of the indications of suspicious activity comprises irregular data flow patterns.
Claim 5
Dependent Claim
24 words
The method of claim 1 wherein at least one of the indications of suspicious activity comprises a user connecting to a peer-to-peer application resource.
Claim 6
Dependent Claim
26 words
The method of claim 1 wherein at least one of the indications of suspicious activity comprises beyond a threshold number of connections to a host system.
Claim 7
Dependent Claim
16 words
The method of claim 5 wherein the host system is a server relative to the connections.
Claim 8
Dependent Claim
15 words
The method of claim 1 wherein the suspicion level is expressed as a suspicion score.
Claim 9
Dependent Claim
40 words
The method of claim 1 wherein the monitoring step comprises collecting raw data corresponding to data flows associated with the at least one user; and processing the collected raw data in a separate process to detect indications of suspicious activity.
Claim 10
Independent Claim
131 words
An apparatus allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, comprising a suspicion scoring module operative to: monitor data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; and generate a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and a bandwidth utilization control module operative to apply bandwidth utilization controls to data flows associated with the at least one user based at least in part on the respective suspicion levels.
Claim 11
Independent Claim
131 words
An apparatus allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, comprising a suspicion scoring module operative to: monitor data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; and generate a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and a bandwidth utilization control module operative to apply bandwidth utilization controls to data flows associated with the at least one user based at least in part on the respective suspicion levels.
Claim 12
Dependent Claim
110 words
The apparatus of claim 9 wherein the bandwidth utilization control module comprises a packet processor, a traffic classification databases and a flow control module; wherein the packet processor is operative to: construct control block objects including attributes characterizing data flows traversing the apparatus, and associate packets to control block objects; wherein the traffic classification database is operative to: operate on control block object attributes to identify traffic classes associated with data flows traversing the apparatus, and associate bandwidth utilization controls to the data flows based on identified traffic classes; and wherein the flow control module is operative to enforce bandwidth utilization controls on data flows associated with corresponding traffic classes.
Claim 13
Dependent Claim
53 words
The apparatus of claim 9 wherein the suspicion scoring module is operative to: execute in the packet processing path to collect raw data associated with data flows traversing the bandwidth utilization control module; and process the collected raw data in a separate process to generate suspicion levels for the at least one user.
Claim 14
Dependent Claim
44 words
The apparatus of claim 9 wherein the suspicion scoring module includes a heightened scrutiny list comprising at least one user identification; and wherein the suspicion scoring module is operative to monitor only the data flows associated with user identifications in the heightened scrutiny list.
Claim 15
Dependent Claim
14 words
The apparatus of claim 12 wherein the user identification is a computer network address.
Claim 16
Dependent Claim
16 words
The apparatus of claim 12 wherein the user identification is a range of computer network addresses.
Claim 17
Dependent Claim
15 words
The apparatus of claim 14 wherein the range is expressed as a computer network subnet.
Claim 18
Dependent Claim
49 words
The apparatus of claim 9 wherein the suspicion scoring module is operative to maintain an exclude list comprising at least one user identification; and wherein the suspicion scoring module is operative to exclude from monitoring data flows associated with the at least one user identification on the exclude list.
Claim 19
Dependent Claim
14 words
The apparatus of claim 16 wherein the user identification is a computer network address.
Claim 20
Dependent Claim
16 words
The apparatus of claim 16 wherein the user identification is a range of computer network addresses.
Claim 21
Dependent Claim
15 words
The apparatus of claim 18 wherein the range is expressed as a computer network subnet.
Claim 22
Dependent Claim
18 words
The apparatus of claim 12 wherein the user identification is a ticket issued by a network authentication mechanism.
Claim 23
Dependent Claim
41 words
The apparatus of claim 10 further comprising a host database storing computer network addresses associated with data flows traversing the apparatus, wherein the host database maintains suspicion levels generated by the suspicion scoring module in association with the computer network addresses.
Claim 24
Dependent Claim
56 words
The apparatus of claim 10 wherein the traffic classification database maintains a traffic class for suspicious users; and wherein the suspicion scoring module is operative to change the configuration of the traffic classification database to classify data lows associated with users having a suspicion level beyond a threshold level in the traffic class for suspicious users.
Claim 25
Independent Claim
120 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; maintaining a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and applying a heightened level of scrutiny to data flows associated with users having a suspicion level beyond a threshold suspicion level.
Claim 26
Independent Claim
120 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one user by a network traffic classification device; maintaining a suspicion level for the at least one user based on detected indications of suspicious activity, wherein the detected indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and applying a heightened level of scrutiny to data flows associated with users having a suspicion level beyond a threshold suspicion level.
Claim 27
Independent Claim
98 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one use, by a network traffic classification device, wherein the indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and maintaining a suspicion level for the at least one user based on detected indications of suspicious activity.
Claim 28
Independent Claim
98 words
A method allowing for bandwidth management schemes responsive to utilization characteristics associated with individual users, the method comprising monitoring, at a network device, data flows relative to at least one user for indications of suspicious activity directed to evading classification of network traffic associated with the at least one use, by a network traffic classification device, wherein the indications of suspicious activity comprise a user connecting to a tunnel proxy resource operative to encrypt data flows corresponding to the user; and maintaining a suspicion level for the at least one user based on detected indications of suspicious activity.
Claim 29
Dependent Claim
17 words
The method of claim 24 further comprising reporting the suspicion level for the at least one user.
Claim 30
Dependent Claim
25 words
The method of claim 25 wherein the reporting step comprises transmitting the suspicion level for the at least one user to a remote network device.
Claim 31
Dependent Claim
15 words
The method of claim 26 wherein the remote network device is a central management server.
Claim 32
Dependent Claim
28 words
The method of claim 24 further comprising modifying the configuration of at least one network device in response to the suspicion level for the at least one user.
Claim 33
Dependent Claim
46 words
The method of claim 1 wherein the monitoring step comprises analyzing network traffic associated with one or more users against one or more traffic pattern templates; and wherein the maintaining step comprises adjusting the suspicion level for the one or more users based on analyzing step.
Claim 34
Dependent Claim
45 words
The method of claim 1 wherein the monitoring step comprises analyzing HTTP network traffic associated with one or more users against an HTTP traffic pattern template; and wherein the maintaining step comprises adjusting the suspicion level for a given user based on the analyzing step.
Claim 35
Dependent Claim
36 words
The method of claim 30 wherein the HTTP traffic pattern template comprises at least one attribute characterizing an expected behavior of regular HTTP traffic, and at least one attribute characterizing a suspicious behavior involving HTTP traffic.
Claim 36
Dependent Claim
44 words
The apparatus of claim 9 wherein the suspicion scoring module is operative to analyze network traffic associated with one or more users against one or more traffic pattern templates; and adjust the suspicion level for the one or more users based on analyzing step.
Claim 37
Dependent Claim
43 words
The apparatus of claim 9 wherein the suspicion scoring module is operative to analyze HTTP network traffic associated with one or more users against an HTTP traffic pattern template; and adjust the suspicion level for a given user based on the analyzing step.
Claim 38
Dependent Claim
36 words
The apparatus of claim 33 wherein the HTTP traffic pattern template comprises at least one attribute characterizing an expected behavior of regular HTTP traffic, and at least one attribute characterizing a suspicious behavior involving HTTP traffic.
References Cited (Backward Citations)
US6339784B1
Cited
US6484203B1
Cited
US6691165B1
Cited
US6934745B2
Cited
US20030018889A1
Cited
US20030235209A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2010-11-12 | 2011-05-14 | 2011-11-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2014-11-12 | 2015-05-14 | 2015-11-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2018-11-12 | 2019-05-14 | 2019-11-13 | $7700.00 | Window Closed / Lapsed |