Peer connection monitoring of network applications
Host end points of a network connection can generate unique connection identifiers that are the same for both ends of the network connection. Both end points of the connection can send the connection identifiers in association with host end point metadata about the connection to a central location, where the metadata of both end points of a connection can be identified by the unique connection identifier.
1. A method for use in identifying network peer connections comprising:
receiving notification of a new network connection being established;
in response to the notification, identifying by a network computer device associated with the new network connection, connection details of the new network connection comprising network identifiers of end points of the new network connection, wherein the network computer device is associated with an end point of the end points;
at the network computer device, ordering the connection details according to a predetermined ordering;
at the network computer device, generating, on a per-application network connection basis, a unique connection identifier from the ordered connection details, wherein at least one of user information and application information is incorporated in the unique connection identifier, and wherein different unique connection identifiers are generated for each connection that the network computer device makes using a network application; and
transmitting from the network computer device, the unique connection identifier and host-specific connection information associated with the new network connection to a server for peer connection monitoring and detection of abnormal behavior for at least one of users and network applications, wherein abnormal behavior of a user is detected based on the user information incorporated in the unique connection identifier, wherein abnormal behavior of the network application is detected based on the application information incorporated in the unique connection identifier, and wherein the unique connection identifier is identical among the end points of the new network connection.
2. The method of claim 1 , wherein the new network connection is a new inbound connection or a new outbound connection.
3. The method of claim 1 , wherein the connection details comprise a source Internet Protocol (IP) address and port number and a destination IP address and port number.
4. The method of claim 3 , wherein the predetermined ordering orders the connection details numerically.
5. The method of claim 1 , wherein the host-specific connection information comprises one or more of:
a host identifier;
a user identifier;
login information;
applications currently running on the network computer device;
an application associated with the new network connection;
a process associated with the new network connection; and
Internet Protocol Flow Information Export (IPFIX) data.
6. The method of claim 1 , further comprising:
receiving, at the server for peer connection monitoring from the network computer device, the unique connection identifier and host-specific connection information;
receiving at the server for peer connection monitoring the unique connection identifier and second host-specific connection information from a second network computer device associated with the new network connection; and
storing the received host-specific connection information and the second host-specific connection information in association with the unique connection identifier.
7. The method of claim 6 , further comprising receiving, at the server, additional host-specific connection information associated with respective additional unique connection identifiers for each end point of a plurality of additional network connections.
8. The method of claim 7 , further comprising processing the stored received host-specific connection information in association with connection information for the plurality of additional network connections to identify normal network connection peer behavior.
9. A network computer device comprising:
a processing unit capable of executing instructions; and
a memory storing instructions, which when executed by the processing unit, configure the network computer device to:
identify connection details of a new network connection comprising network identifiers of end points of the new network connection, wherein the network computer device is associated with an end point of the end points;
arrange the connection details according to a predetermined ordering;
generate, on a per-application network connection basis, a unique connection identifier from the arranged connection details, wherein at least one of user information and application information is incorporated in the unique connection identifier, and wherein different unique connection identifiers are generated for each connection that the network computer device makes using a network application; and
transmit from the network computer device, the unique connection identifier and host-specific connection information associated with the new network connection to a server for peer connection monitoring and for detection of abnormal behavior for at least one of users and network applications, wherein abnormal behavior of a user is detected based on the user information incorporated in the unique connection identifier, wherein abnormal behavior of the network application is detected based on the application information incorporated in the unique connection identifier, and wherein the unique connection identifier is identical among the end points of the new network connection.
10. The network computer device of claim 9 , wherein the new network connection is a new inbound connection or a new outbound connection.
11. The network computer device of claim 9 , wherein the connection details comprise a source Internet Protocol (IP) address and port number and a destination IP address and port number.
12. The network computer device of claim 11 , wherein the predetermined ordering orders the connection details numerically.
13. The network computer device of claim 9 , wherein the host-specific connection information comprises one or more of:
a host identifier;
a user identifier;
login information;
applications currently running on the network computer device;
an application associated with the new network connection;
a process associated with the new network connection; and
Internet Protocol Flow Information Export (IPFIX) data.
14. A system for use in identifying network peer connections comprising:
a plurality of network computer devices coupled to a communication network, each network computer device comprising:
a processing unit capable of executing instructions; and
a memory storing instructions, which when executed by the processing unit of the network computer device, configure the network computer device to:
identify connection details of a new network connection comprising network identifiers of end points of the new network connection, wherein the network computer device is associated with an end point of the end points;
arrange the connection details according to a predetermined ordering;
generate, on a per-application network connection basis, a unique connection identifier from the arranged connection details, wherein at least one of user information and application information is incorporated in the unique connection identifier, and wherein different unique connection identifiers are generated for each connection that the network computer device makes using a network application; and
transmit from the network computer device, the unique connection identifier and host-specific connection information associated with the new network connection to a server for peer connection monitoring and for detection of abnormal behavior for at least one of user and network applications, wherein abnormal behavior of a user is detected based on the user information incorporated in the unique connection identifier, and wherein abnormal behavior of the network application is detected based on the application information incorporated in the unique connection identifier;
the server for peer connection monitoring comprising:
a processing unit capable of executing instructions; and
a memory storing instructions, which when executed by the processing unit of the server, configure the server to:
receive respective connection identifiers and associated host-specific connection information from the plurality of network computer devices, wherein receiving the respective connection identifiers comprises receiving the unique connection identifier from at least the network computer device, and wherein the unique connection identifier is identical among the end points of the new network connection; and
store the received respective connection identifiers and associated host-specific connection information.
15. The system of claim 14 , wherein the instructions stored in the memory of the server comprise instructions which when executed by the processing unit of the server further configure the server to receive additional host-specific connection information associated with respective additional connection identifiers for each end point of a plurality of additional network connections.
16. The system of claim 15 , wherein the instructions stored in the memory of the server comprise instructions which when executed by the processing unit of the server further configure the server to process the stored received associated host-specific connection information stored in association with connection information for the plurality of additional network connections to identify normal network connection peer behavior.
17. The system of claim 14 , wherein the host-specific connection information comprises one or more of:
a host identifier;
a user identifier;
login information;
applications currently running on the network computer device;
an application associated with the new network connection;
a process associated with the new network connection; and
Internet Protocol Flow Information Export (IPFIX) data.
18. The system of claim 14 , wherein the instructions stored in the memory of the network computer device comprise instructions which when executed by the processing unit of the network computer device further configure the network computer device to generate a hash with the host-specific connection information and provide the hash to the server, wherein:
the hash is generated from the arranged connection details such that the hash matches another hash generated at a second end point of the end points; and
the second end point is an opposite end of the new network connection compared to the end point.
19. The system of claim 18 , wherein the instructions stored in the memory of the server comprise instructions which when executed by the processing unit of the server further configure the server to compare the hash with a plurality of other hashes for purposes of matching the hash with the another hash generated at the second end point.
20. The method of claim 1 , wherein the host-specific connection information comprises an ordered listing of at least two of the following: an event category, an event code, an IP address, a timestamp, a process instance ID, a user ID, a user type, an application name, and an application path.