Granted Patent B2

US 7,698,730 · App. 10/803,167 · Granted Apr 13, 2010

Abstract

Claims (30)

1. A method for detection of a new service involving a host in a network, the method comprises:

retrieving a baseline list of port and/or service protocols used by a host being tracked, the baseline list listing service and/or port protocols used by that host over a baseline period that is of a longer duration than a current period;

retrieving a current list of service and/or port protocols for the current period used by the host being tracked;

determining whether there is a difference in the protocols, by finding a protocol that was in the current list but was not in the baseline list; and if there is a difference;

determining whether the host is providing or using the new service;

determining if the host is sending traffic using a protocol not in the current list;

identifying an alert rule corresponding to whether the host is providing or using the new service; and

issuing an alert based at least on the identified alert rule and whether the host is providing or using the new service.

2. The method of claim 1 further comprising:

retrieving a value corresponding to an alert severity level set for violation of the rule.

3. The method of claim 1 wherein a property of the host being tracked is that the host is at least one of a specific host, any host in a specific role, any host in a specific segment, or any host.

4. The method of claim 1 wherein the extent of the determining is configured for that host, in its role, in its segment or anywhere in the network.

5. The method of claim 1 wherein the baseline and current lists of protocols are provided from data in a connection table.

6. A computer program product residing on a computer readable medium for detection of new services in a network, the computer program product comprising instructions for causing a computer to:

retrieve a baseline list of port and/or service protocols used by a host being tracked, the baseline list listing service and/or port protocols used by that host over a baseline period that is of a longer duration that a current period;

aggregating communication information between every host pair;

retrieve a current list of service and/or port protocols for the current period used by the host being tracked;

determine whether there is a difference in the protocols, by identifying a protocol that was in a the current list but was not in the baseline list; and if there is a difference;

determine whether the host is providing or using the new service;

determining if the host is sending traffic using a protocol not in the current list;

identify an alert rule corresponding to whether the host is providing or using the new service; and

issue an alert based at least on the identified alert rule and whether the host is providing or using the new service.

7. The computer program product of claim 6 wherein instructions to indicate further comprise instructions to:

issue an alert if the new service is detected.

8. The computer program product of claim 6 further comprising instructions to:

retrieve a value corresponding to the alert severity level set for violation of the rule.

9. The computer program product of claim 6 wherein a property of the host being track is that the host is at least one of a specific host, any host in a specific role, any host in a specific segment, or any host.

10. The computer program product of claim 6 wherein the extent of the determining is configured to for that host, in its role, in its segment or anywhere in the network.

11. The computer program product of claim 6 further comprising instructions to:

access a connection table to provide data for the baseline and current lists of protocols.

Assignments (21)