System and method for dynamically controlling a rogue application through incremental bandwidth restrictions
View Patent ↗A system and method for dynamically controlling a rogue application through incremental bandwidth restrictions is disclosed. A network connection supporting a flow of network traffic in a distributed computing environment is monitored. The network traffic flow includes a stream of data packets generated by a rogue application. Bandwidth allocated to the monitored network connection is incrementally adjusted until the flow of the network traffic for the rogue application achieves a steady state of bandwidth restriction. The flow of subsequent network traffic over the monitored network connection is controlled at the steady state of bandwidth restriction.
1. An apparatus for managing network traffic exchanged with a proscribed application capable of taking evasive action, comprising:
a processor;
a memory; and
computer-executable program code stored in a storage medium and executable by the processor, the computer-executable program code comprising
a flow analyzer module comprising computer-executable instructions for analyzing flow characteristics of network traffic comprising a multiplicity of transient packets each including a parameterized header, comprising:
a parser module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to retrieve operational characteristics from the parameterized header of each such transient packet generated by a plurality of intercommunicating applications;
a comparator module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to identify a proscribed application by comparing the operational characteristics to stored characteristics unique to the proscribed application; and
a flow monitor module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to control transmission of each such transient packet subsequently exchanged with the proscribed application, comprising:
a traffic manager module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to dynamically and incrementally restrict bandwidth allocated to the network traffic specifically exchanged with the proscribed application until an evasive action is detected, wherein the evasive action comprises an action associated with the proscribed application that changes one or more operational characteristics of network traffic of the proscribed application.
2. An apparatus according to claim 1 , further comprising: a classifier module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to classify at least one of a connection to the proscribed application by examining connection initialization operational characteristics, a login to the proscribed application by examining session initiation operational characteristics, and a raw data flow to the proscribed application by examining data flow operational characteristics.
3. An apparatus according to claim 1 , further comprising: a bandwidth restriction store recording a bandwidth restriction threshold at which the evasive action by the proscribed application was triggered.
4. An apparatus according to claim 1 , wherein the traffic manager module further comprises computer-executable instructions configured, when executed by the processor, to cause the processor to relax the bandwidth allocated to the network traffic specifically exchanged with the proscribed application by at least one increment responsive to the evasive action.
5. An apparatus according to claim 1 , wherein the operational characteristics comprise at least one of a network address, port and traffic direction flow.
6. The apparatus of claim 1 wherein the action comprises port hopping.
7. The apparatus of claim 1 wherein the action comprises address hopping.
8. The apparatus of claim 1 wherein the action comprises switching of client-server roles.
9. The apparatus of claim 1 wherein the action is an attempt to evade detection of the proscribed application.
10. A method for managing network traffic exchanged with a proscribed application capable of taking evasive action, comprising:
analyzing, at a network device operably connected to a network communications path, flow characteristics of network traffic comprising a multiplicity of transient packets each including a parameterized header, comprising:
retrieving operational characteristics from the parameterized header of each such transient packet generated by a plurality of intercommunicating applications;
identifying a proscribed application by comparing the operational characteristics to stored characteristics unique to the proscribed application; and
controlling transmission of each such transient packet subsequently exchanged with the proscribed application, comprising:
dynamically and incrementally restricting bandwidth allocated to the network traffic specifically exchanged with the proscribed application until an evasive action is detected, wherein the evasive action comprises an action associated with the proscribed application that changes one or more operational characteristics of network traffic of the proscribed application.
11. A method according to claim 10 , further comprising: classifying at least one of a connection to the proscribed application by examining connection initialization operational characteristics, a login to the proscribed application by examining session initiation operational characteristics, and a raw data flow to the proscribed application by examining data flow operational characteristics.
12. A method according to claim 10 , further comprising: recording a bandwidth restriction threshold at which the evasive action by the proscribed application was triggered.
13. A method according to claim 10 , further comprising: relaxing the bandwidth allocated to the network traffic specifically exchanged with the proscribed application by at least one increment responsive to the evasive action.
14. A method according to claim 10 , wherein the operational characteristics comprise at least one of a network address, port and traffic direction flow.
15. A computer-readable storage medium holding code for performing the method according to claim 10 .
16. An apparatus for dynamically controlling a rogue application through incremental bandwidth restrictions, comprising:
a processor;
a memory; and
computer-executable program code stored in a storage medium and executable by the processor, the computer-executable program code comprising
a flow monitor module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to
monitor a network connection supporting a flow of network traffic in a distributed computing environment, the network traffic flow comprising a stream of data packets generated by a rogue application, and
incrementally adjust bandwidth allocated to the monitored network connection until the flow of the network traffic for the rogue application achieves a steady state of bandwidth restriction, comprising:
the flow monitor module further comprising computer-executable instructions operative, when executed by the processor, to cause the processor to dynamically decrease the bandwidth allocated to the monitored network connection for each new flow of network traffic until an evasive action by the rogue application is detected, wherein the evasive action comprises an action associated with the proscribed application that changes one or more operational characteristics of network traffic of the proscribed application; and
a traffic manager module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to control the flow of subsequent network traffic over the monitored network connection at the steady state of bandwidth restriction.
17. An apparatus according to claim 16 , wherein the flow monitor module further comprises computer-executable instructions configured to cause the processor to increase the bandwidth allocated to the monitored network connection for a subsequent new flow of network traffic responsive to the evasive action.
18. An apparatus according to claim 16 , wherein the flow monitor module further comprises computer-executable instructions configured, when executed by the processor, to cause the processor to store the steady state of bandwidth restriction as a retrievable traffic flow control.
19. An apparatus according to claim 16 , further comprising: a flow analyzer module comprising computer-executable instructions configured, when executed by the processor, to cause the processor to perform at least one of identifying evasive action or other form of negative response taken by the rogue application and examining at least one of a network address, port and characteristics stored as parameters in a header of each such packet.
20. An apparatus according to claim 16 , wherein the flow monitor module further comprises computer-executable instructions configured, when executed by the processor, to cause the processor to monitor a redirected packet flow facilitated by the rogue application.
21. An apparatus according to claim 16 , wherein the steady state of bandwidth restriction is sufficient to not trigger evasive action or other form of negative response by the rogue application.
22. A method for dynamically controlling a rogue application through incremental bandwidth restrictions, comprising:
monitoring, at a network device operably connected to a network communications path, a network connection supporting a flow of network traffic in a distributed computing environment, the network traffic flow comprising a stream of data packets generated by a rogue application;
incrementally adjusting bandwidth allocated to the monitored network connection until the flow of the network traffic for the rogue application achieves a steady state of bandwidth restriction, comprising:
dynamically decreasing the bandwidth allocated to the monitored network connection for each new flow of network traffic until an evasive action by the rogue application is detected, wherein the evasive action comprises an action associated with the proscribed application that changes one or more operational characteristics of network traffic of the proscribed application; and
controlling the flow of subsequent network traffic over the monitored network connection at the steady state of bandwidth restriction.
23. A method according to claim 22 , further comprising:
increasing the bandwidth allocated to the monitored network connection for a subsequent new flow of network traffic responsive to the evasive action.
24. A method according to claim 22 , further comprising:
storing the steady state of bandwidth restriction as a retrievable traffic flow control.
25. A method according to claim 22 , further comprising:
performing at least one of identifying evasive action or other form of negative response taken by the rogue application and examining at least one of a network address, port and characteristics stored as parameters in a header of each such packet.
26. A method according to claim 22 , further comprising:
monitoring a redirected packet flow facilitated by the rogue application.
27. A method according to claim 22 , wherein the steady state of bandwidth restriction is sufficient to not trigger evasive action or other form of negative response by the rogue application.
28. A computer-readable storage medium holding code for performing the method according to claim 22 .