Network analysis system and method utilizing collected metadata
View Patent ↗A system, method and computer program product are provided for analyzing network traffic associated with network services. Initially, network traffic and metadata are collected from a network. Thereafter, the network traffic is analyzed utilizing the metadata.
1. A computer-implemented method, comprising:
collecting network traffic;
generating a command, based on the network traffic, that invokes a web service, which generates metadata to be used in analyzing the network traffic;
collecting the metadata, wherein the metadata comprises one or more Web Service Definition Language (WSDL) documents;
correlating the network traffic with the metadata;
identifying a portion of the network traffic correlated with a portion of the metadata having the one or more WSDL documents;
generating a parser, which is based, at least in part, on the portion of the metadata having the one or more WSDL documents, to analyze the portion of the network traffic, wherein the parser indicates a syntax that is expected of the portion of the network traffic; and
determining whether invocations and responses for the web service in the portion of the network traffic are correctly formed.
2. The computer-implemented method as recited in claim 1 , wherein the parser checks the network traffic for syntax errors.
3. The computer-implemented method as recited in claim 1 , wherein the parser receives input in a form of at least one of: source program instructions, interactive online commands, markup tags, and a defined interface.
4. The computer-implemented method as recited in claim 1 , wherein the parser is provided as part of a compiler configured to receive input, which is broken into objects or attributes.
5. The computer-implemented method as recited in claim 1 , wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.
6. The computer-implemented method as recited in claim 1 , wherein the metadata indicates scanning particular payloads, which are associated with web services, for malware.
7. The computer-implemented method as recited in claim 1 , wherein the metadata includes a database schema.
8. Logic encoded in one or more non-transitory computer readable media that includes code executable by one or more processors, wherein the code causes the one or more processors to perform operations, comprising:
collecting network traffic;
generating a command, based on the network traffic, that invokes a web service, which generates metadata to be used in analyzing the network traffic;
collecting the metadata, wherein the metadata comprises one or more Web Service Definition Language (WSDL) documents;
correlating the network traffic with the metadata;
identifying a portion of the network traffic correlated with a portion of the metadata having the one or more WSDL documents;
generating a parser, which is based, at least in part, on the portion of the metadata having the one or more WSDL documents, to analyze the portion of the network traffic, wherein the parser indicates a syntax that is expected of the portion of the network traffic; and
determining, using the parser, whether invocations and responses for the web service in the portion of the network traffic are correctly formed.
9. The logic as recited in claim 8 , wherein the parser checks the network traffic for syntax errors, and wherein the parser is provided as part of a compiler configured to receive input, which is broken into objects or attributes.
10. The logic as recited in claim 8 , wherein the parser receives input in a form of at least one of: source program instructions, interactive online commands, markup tags, and a defined interface.
11. The logic as recited in claim 8 , wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.
12. An apparatus, comprising:
a network traffic collector;
a metadata aggregator;
a network analyzer coupled to the network traffic collector and the metadata aggregator; and
one or more processors operable to execute instructions associated with the network traffic collector, the metadata aggregator, and the network analyzer such that the apparatus including the one or more processors is configured to:
collect network traffic;
generate a command, based on the network traffic, that invokes a web service, which generates metadata to be used in analyzing the network traffic;
collect the metadata, wherein the metadata comprises one or more Web Service Definition Language (WSDL) documents;
correlate the network traffic with the metadata;
identify a portion of the network traffic correlated with a portion of the metadata having the one or more WSDL documents;
generate a parser, which is based, at least in part, on the portion of the metadata having the one or more WSDL documents, to analyze the portion of the network traffic, wherein the parser indicates a syntax that is expected of the portion of the network traffic; and
determine, using the parser, whether invocations and responses for the web service in the portion of the network traffic are correctly formed.
13. The apparatus of claim 12 , wherein the command is associated with a service call, which is selected from a universal description, discovery, and integration (UDDI) registry that lists the service call as being associated with the application service provider.
14. The apparatus of claim 12 , wherein the apparatus is further configured for:
identifying a message in the network traffic to be authenticated based on the metadata; and
generating a particular parser, which is based on collected metadata, for analyzing the network traffic, wherein the particular parser checks the network traffic for syntax errors.