Granted Patent B2

US 8,295,198 · App. 12/000,910 · Granted Oct 23, 2012

Abstract

Claims (40)

1. A system for dynamically controlling network communications, the system comprising:

a network device configured to receive network traffic and to produce a plurality of flow records describing said network traffic;

a flow record storage configured to receive said flow records from said network device and to store said flow records; and

a data analysis tool configured to access the flow record storage to retrieve said stored flow records and to assess each of said flow records according to predefined criteria to dynamically identify an address, wherein the data analysis tool is further configured to implement statistical models configured to solve network usage related problems, and wherein the data analysis tool uses the flow records and statistical models to generate a statistical result that is then stored in the flow record storage;

wherein each of said plurality of flow records comprises a sequence number identifying the flow record, a source node address, a destination node address, a source port address, a destination port address, and number of bytes or packets transmitted in each associated flow, and

wherein the predefined criteria comprises the total number of bytes transmitted in the associated flow for each of the node or port addresses,

wherein the network device is configured to receive said identified address and to add said identified address to an access control list to prevent forwarding traffic associated with said identified address; and

an input/output device configured to display to a user said identified address received from the data analysis tool, and wherein the data analysis tool is configured to forward the identified address to the network device to be added to the access control list only if the user provides an input to accept the identified address.

2. The system of claim 1 further comprising an access control list storage configured to store said identified address and to provide said identified address to the network device.

3. The system of claim 1 , wherein said flow records are aggregated according to said node and/or port addresses.

4. The system of claim 1 , wherein the input/out device further acquires and displays flow records data associated with said identified address.

5. A method for managing a network comprising:

monitoring traffic through components in the network;

receiving flow records from said components describing said traffic;

analyzing the flow records and identifying an address that meets a predefined criterion, wherein the predefined criterion comprises a maximum total number of bytes associated with an address;

displaying to a user said identified address; and

after the user approves the identified address, forwarding the identified address to one of the network components, wherein said component adds the identified address to an associated access control list, wherein said access control list directs the component to prevent forwarding traffic associated with said identified address.

6. The method of claim 5 , wherein said identified address is automatically removed from the access control list after a predefined time period.

7. The method of claim 5 , wherein said address identifies at least one of a source node, a destination node, a source port, and a destination port.

8. The method of claim 7 , wherein said address identifies a source node.

9. The method of claim 5 , further comprising displaying to the user flow records data associated with said identified address.

10. A system for dynamically controlling traffic in a network, the system comprising:

a flow record generating device configured to provide flow records describing said network traffic;

a flow record storage system configured to receive and store the flow records;

a data analysis device configured to access the storage system and to assess the stored flow records according to predefined criteria;

wherein the data analysis device is configured to dynamically identify at least one address satisfying said predefined criteria, said at least one address comprising a port or a node address associated with the traffic, and

wherein the identified at least one address is added to an access control list and components in the network will not forward traffic associated with addresses in the access control list,

wherein each of said flow records comprises a time stamp, and wherein the predefined criteria comprises a time window.

11. The system of claim 10 , wherein the flow data storage system is configured to aggregate the flow records.

12. The system of claim 10 , further comprising a user interface configured to display to a user said identified address, and whereby the identified address is added to the access control list only after the user accepts the identified address.

13. The system of claim 12 , wherein the user interface is further configured to display to the user flow records data associated with said identified address.

14. A method for evaluating an address on an access control list, the method comprising:

monitoring traffic through components in the network;

receiving flow records from said components describing said traffic;

analyzing any of said received flow records associated with said address in the access control list according to a predefined criterion;

renewing the address in the access control list if said address satisfies said predefined criterion; and

displaying to a user said address, and wherein the renewing of the address occurs after the user approves the address.

15. The method of claim 14 , further comprising displaying to the user flow records data associated with said address.

16. The method of claim 14 , wherein said address identifies at least one of a source node, a destination node, a source port, and a destination port.

17. The method of claim 14 , wherein said address is automatically removed from the access control list after a predefined time period.

Assignments (13)