Multi-tiered scalable network monitoring
View Patent ↗A network analysis architecture provides a suite of complementary logic operable at different temporal and spatial timescales. The distinct temporal and spatial scales define different tiers, each analyzing network events according to predetermined temporal and spatial scales of progressive magnitude. Particular event detection logic may be operable on an immediate temporal scale, while other logic identifies trends over a longer time period. Similarly, different spatial scales are appropriate to different algorithms, as in logic that examines only headers or length of packets, or inspects an entire payload or transferred file. Deployment of logic that is focused on different timing and scope of data allows timely action in the case of readily apparent deviations, and permits longer term analysis for identifying trends that emerge over time. By selecting a suite of complementary logic directed at different deviant behavior, the focus of a single logic scheme is not charged with producing absolute screening of all traffic.
1. A method of gathering network traffic for analysis of undesirable trends comprising:
defining a plurality of tiers for gathering network traffic, each of the plurality of tiers having a temporal scale and spatial scale independent of the others of the plurality of tiers, the temporal scale defining the timing of observed packets and the spatial scale defining a scope of analysis performed on observed packets, the plurality of tiers including a network element tier for gathering and analyzing events at a line speed of the network traffic, and an aggregate tier for gathering and analyzing events from multiple sources;
gathering according to the temporal scale of the plurality of the tiers, data from the network traffic, the gathered data defining a plurality of events;
analyzing, according to the spatial scale of at least one of the tiers, the gathered network data, analyzing including analyzing according to the plurality of spatial scales from which the analyzed data was gathered;
determining, based on the analyzing, if the analyzed data indicates an alert, the alert indicative of remedial operations; and
generating, if an alert is indicated, a responsive action directed to the indicated remedial operations, the network element tier comprising sensors, the sensors specialized for a predetermined purpose, and gathering comprises gathering a portion of the network data, the gathered portion predetermined according to a particular sensor deployed in the respective network element and directed to an event defined by a single condition.
2. The method of claim 1 wherein the defined plurality of tiers include a network element tier, the network element tier having element logic, the element logic executing at a line speed of the network traffic, analyzing the event within a temporal scale of the line speed and a spatial scale defined by traffic gathered at a deployment point of the network element.
3. The method of claim 2 wherein the defined plurality of tiers includes an aggregated tier, the aggregated tier having aggregate logic, the aggregate logic operating on data structures received from the network element tier, the aggregate logic having a temporal scale of a plurality of events and a spatial scale of a plurality of deployed network elements.
4. The method of claim 3 wherein the plurality of tiers further comprises an archive tier, the archive tier executing archive logic, the temporal scale of the archive logic analyzing events independent of the timing of any particular attack and the spatial scale including historical trends of the gathered events.
5. The method of claim 4 further comprising:
correlating events received from the aggregated and archive tiers; and
issuing feedback to the network sensor, aggregated, and archive tiers.
6. The method of claim 3 further comprising legacy collectors, the legacy collectors for identifying trends associated with previously identified undesirable behavior, the aggregate logic invoking data from the legacy collectors for comparison with the gathered events.
7. The method of claim 1 wherein the aggregate tier comprises data structures receivable from a plurality of sensors in the network element tier and directed to analyzing events from multiple sources, the multiple sources including the plurality of network elements.
8. The method of claim 7 further comprising:
correlating events from the network element tier and the aggregated tier, correlating identifying events indicative of undesirable behavior based on others of the correlated events; and
issuing feedback to the aggregated tier for use with analyzing subsequent events.
9. The method of claim 1 wherein the sensors are responsive to the element logic for:
examining a portion of a network traffic packet, the portion being a subset of the data in the packet; and
advancing to successive packets if a particular packet is incompletely analyzed within the element time scale.
10. The method of claim 1 further comprising deploying the sensors in the network element to analyze particular portions of the message packet, the particular portion for identifying a particular sequence residing in a subset of the entire packet.
11. The method of claim 10 wherein the sensor is specialized to identify only a specific feature such that the entire packet need not be analyzed by any particular sensor such that the sensor performs at line speed.
12. The method of claim 1 wherein the line speed at which the network elements operate is substantially on the order of 10-100 Gbs/s, and wherein:
the network element tier perform without impeding the underlying traffic flow is a priority, with the recognition that all patterns or packets may not be available within the given time window;
the aggregate tier which receives data structures populated by the sensors of the network element tier and operates on data from multiple sensors, such that multiple sensory inputs are permitted to complement each other to identify an event; and
the archive tier includes logic for analyzing current data in light of historical trends observed from previous traffic for events that are not directly tied to a single packet or occurrence.
13. A multi-tiered architecture for analyzing network traffic comprising:
a plurality of tiers for gathering network traffic, each of the plurality of tiers having a temporal scale and spatial scale independent of the others of the plurality of tiers, the temporal scale defining the timing of observed packets and the spatial scale defining a scope of analysis performed on observed packets, the tiers including:
a network element tier for gathering and analyzing events at a line speed of the network traffic;
an aggregate tier for gathering and analyzing events from multiple sources; and
an archive tier, the archive tier executing archive logic, the temporal scale of the archive logic analyzing events independent of the timing of any particular attack and the spatial scale including historical trends of the gathered events;
gathering, according to the temporal scale of at least one of the tiers, data from the network traffic, the gathered data defining an event;
element logic analyzing, according to the spatial scale of the network element tier, the gathered network data, and determining, based on the analyzing, events, the element logic executing at a line speed of the network traffic, analyzing the event within a temporal scale of the line speed and a spatial scale defined by traffic gathered at a deployment point of the network element;
aggregator logic analyzing, according to the spatial scale of the aggregate tier, the gathered network data, and determining, based on the analyzing, events;
a correlator, the correlator having correlation logic for analyzing the events from a plurality of the tiers;
determining, based on the analyzing, if the analyzed data indicates an alert, the alert indicative of remedial operations; and
generating, if an alert is indicated, a responsive action directed to the indicated remedial operations.
14. The architecture of claim 13 wherein network element tier comprises sensors, each of the sensors specialized for a predetermined purpose, and gathering comprises gathering a portion of the network data, the gathered portion predetermined according to a particular sensor deployed in the respective network element and directed to an event defined by a single condition.
15. The architecture of claim 14 wherein the sensors are responsive to the element logic for:
examining a portion of a network traffic packet, the portion being a subset of the data in the packet; and
advancing to successive packets if a particular packet is incompletely analyzed within the element time scale.
16. The architecture of claim 13 wherein the aggregate logic operates on data structures received from the network element tier, the aggregate logic having a temporal scale of a plurality of events and a spatial scale of a plurality of deployed network elements.
17. The architecture of claim 16 further comprising:
correlating events received from the aggregated tiers; and
issuing feedback to the network sensor tiers, the feedback recognized by the element logic for determining successive events.
18. The architecture of claim 13 wherein the plurality of tiers further comprises an archive tier, the archive tier executing archive logic, the temporal scale of the archive logic analyzing events independent of the timing of any particular attack and the spatial scale including historical trends of the gathered events.
19. A computer program product having computer program code on a non-transitory computer readable storage medium including a set of encoded instructions that, when executed by a processor, cause the computer to perform method of analyzing network, the method comprising:
defining a plurality of tiers for gathering network traffic, each of the plurality of tiers having a temporal scale and spatial scale independent of the others of the plurality of tiers, the temporal scale defining the timing of observed packets and the spatial scale defining a scope of analysis performed on observed packets, the plurality of tiers including a network element tier for gathering and analyzing events at a line speed of the network traffic, and an aggregate tier for gathering and analyzing events from multiple sources;
gathering according to the temporal scale of the plurality of the tiers, data from the network traffic, the gathered data defining a plurality of events;
analyzing, according to the spatial scale of at least one of the tiers, the gathered network data, analyzing including analyzing according to the plurality of spatial scales from which the analyzed data was gathered;
determining, based on the analyzing, if the analyzed data indicates an alert, the alert indicative of remedial operations; and
generating, if an alert is indicated, a responsive action directed to the indicated remedial operations,
the network element tier comprising sensors, the sensors specialized for a predetermined purpose, and gathering comprises gathering a portion of the network data, the gathered portion predetermined according to a particular sensor deployed in the respective network element and directed to an event defined by a single condition.