Granted Patent B2

US 11,388,072 · App. 17/337,299 · Granted Jul 12, 2022

Inventors: Xue Jun Wu (Seattle, WA); Arindum Mukerji (Seattle, WA); Jeff James Costlow (Kingston, WA); Michael Kerber Krause Montague (Lake Forest Park, WA); Jesse Abraham Rothstein (Seattle, WA); Matthew Alexander Schurr (Mercer Island, WA)

Assignee: ExtraHop Networks, Inc.

H04L43/08H04L47/41

Abstract

Claims (120)

1. A method for monitoring network traffic using one or more network monitoring computers, comprising:

monitoring two or more network segments that are coupled by a traffic transformation device (TFD);

determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;

determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the non-encrypted internal network traffic exchanged between one or more internal endpoints and the TFD;

providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics; and

in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:

associating the external network address and the internal network address with each other based on the correlation score; and

providing a report that includes information about an association of the external network address with the internal network address.

2. The method of claim 1 , further comprising:

determining a first metric associated with each of the one or more external network addresses based on a first amount of the encrypted network traffic sent from each external network address;

determining a second metric associated with each of the one or more external network addresses based on a second amount of the encrypted network traffic received by each external network address;

determining a third metric associated with each of the one or more internal network addresses based on a third amount of the internal network traffic sent from each internal network address;

determining a fourth metric associated with each of the one or more internal network addresses based on a fourth amount of the internal network traffic received by each internal network address; and

updating the one or more correlation scores based on one or more similarities between the two or more of the first metric, the second metric, the third metric, or the fourth metric over a time interval.

3. The method of claim 1 , further comprising:

determining one or more turns occurring on the encrypted network traffic based on identifying a change of direction of the encrypted network traffic, wherein the change of direction is indicated by the one or more metrics;

determining one or more other turns occurring on the internal network traffic based on identifying a change of direction of the internal network traffic, wherein the change of direction is indicated by the one or more other metrics; and

updating the one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more similarities of the one or more turns and the one or more other turns.

4. The method of claim 1 , further comprising:

determining one or more internal services that are associated with one or more portions of the internal network traffic associated with the internal network address based on the one or more characteristics of the internal network traffic associated with the internal network address;

associating the one or more internal services with the external network address; and

including information about the one or more internal services in the report.

5. The method of claim 1 , further comprises:

progressively updating information associated with one or more metrics associated with the one or more external network addresses based on monitoring the encrypted network traffic in the one or more network segments; and

progressively updating other information associated with one or more other metrics associated with the one or more internal network addresses based on monitoring the internal network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

6. The method of claim 1 , wherein the traffic forwarding device is one or more of a virtual private network gateway or network traffic proxy.

7. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform a method comprising:

monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);

determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;

determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;

providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics; and

in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:

associating the external network address and the internal network address with each other based on the correlation score; and

providing a report that includes information about an association of the external network address with the internal network address.

8. The media of claim 7 , further comprising:

determining a first metric associated with each of the one or more external network addresses based on a first amount of the encrypted network traffic sent from each external network address;

determining a second metric associated with each of the one or more external network addresses based on a second amount of the encrypted network traffic received by each external network address;

determining a third metric associated with each of the one or more internal network addresses based on a third amount of the internal network traffic sent from each internal network address;

determining a fourth metric associated with each of the one or more internal network addresses based on a fourth amount of the internal network traffic received by each internal network address; and

updating the one or more correlation scores based on one or more similarities between the two or more of the first metric, the second metric, the third metric, or the fourth metric over a time interval.

9. The media of claim 7 , further comprising:

determining one or more turns occurring on the encrypted network traffic based on identifying a change of direction of the encrypted network traffic, wherein the change of direction is indicated by the one or more metrics;

determining one or more other turns occurring on the internal network traffic based on identifying a change of direction of the internal network traffic, wherein the change of direction is indicated by the one or more other metrics; and

updating the one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more similarities of the one or more turns and the one or more other turns.

10. The media of claim 7 , further comprising:

determining one or more internal services that are associated with one or more portions of the internal network traffic associated with the internal network address based on the one or more characteristics of the internal network traffic associated with the internal network address;

associating the one or more internal services with the external network address; and

including information about the one or more internal services in the report.

11. The media of claim 7 , further comprises:

progressively updating information associated with one or more metrics associated with the one or more external network addresses based on monitoring the encrypted network traffic in the one or more network segments;

progressively updating other information associated with one or more other metrics associated with the one or more internal network addresses based on monitoring the internal network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

12. The media of claim 7 , wherein the traffic forwarding device is one or more of a virtual private network gateway or network traffic proxy.

13. A system for monitoring network traffic in a network:

one or more network monitoring computers (NMCs), comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);

determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;

determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;

providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics; and

in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:

associating the external network address and the internal network address with each other based on the correlation score; and

providing a report that includes information about an association of the external network address with the internal network address; and

one or more client computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing one or more portions of the encrypted network traffic.

14. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining a first metric associated with each of the one or more external network addresses based on a first amount of the encrypted network traffic sent from each external network address;

determining a second metric associated with each of the one or more external network addresses based on a second amount of the encrypted network traffic received by each external network address;

determining a third metric associated with each of the one or more internal network addresses based on a third amount of the internal network traffic sent from each internal network address;

determining a fourth metric associated with each of the one or more internal network addresses based on a fourth amount of the internal network traffic received by each internal network address; and

updating the one or more correlation scores based on one or more similarities between the two or more of the first metric, the second metric, the third metric, or the fourth metric over a time interval.

15. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining one or more turns occurring on the encrypted network traffic based on identifying a change of direction of the encrypted network traffic, wherein the change of direction is indicated by the one or more metrics;

determining one or more other turns occurring on the internal network traffic based on identifying a change of direction of the internal network traffic, wherein the change of direction is indicated by the one or more other metrics; and

updating the one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more similarities of the one or more turns and the one or more other turns.

16. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining one or more internal services that are associated with one or more portions of the internal network traffic associated with the internal network address based on the one or more characteristics of the internal network traffic associated with the internal network address;

associating the one or more internal services with the external network address; and

including information about the one or more internal services in the report.

17. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

progressively updating information associated with one or more metrics associated with the one or more external network addresses based on monitoring the encrypted network traffic in the one or more network segments;

progressively updating other information associated with one or more other metrics associated with the one or more internal network addresses based on monitoring the internal network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

18. The system of claim 13 , wherein the traffic forwarding device is one or more of a virtual private network gateway or network traffic proxy.

19. A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);

determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;

determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;

providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics; and

in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:

associating the external network address and the internal network address with each other based on the correlation score; and

providing a report that includes information about an association of the external network address with the internal network address.

20. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining a first metric associated with each of the one or more external network addresses based on a first amount of the encrypted network traffic sent from each external network address;

determining a second metric associated with each of the one or more external network addresses based on a second amount of the encrypted network traffic received by each external network address;

determining a third metric associated with each of the one or more internal network addresses based on a third amount of the internal network traffic sent from each internal network address;

determining a fourth metric associated with each of the one or more internal network addresses based on a fourth amount of the internal network traffic received by each internal network address; and

updating the one or more correlation scores based on one or more similarities between the two or more of the first metric, the second metric, the third metric, or the fourth metric over a time interval.

21. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining one or more turns occurring on the encrypted network traffic based on identifying a change of direction of the encrypted network traffic, wherein the change of direction is indicated by the one or more metrics;

determining one or more other turns occurring on the internal network traffic based on identifying a change of direction of the internal network traffic, wherein the change of direction is indicated by the one or more other metrics; and

updating the one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more similarities of the one or more turns and the one or more other turns.

22. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining one or more internal services that are associated with one or more portions of the internal network traffic associated with the internal network address based on the one or more characteristics of the internal network traffic associated with the internal network address;

associating the one or more internal services with the external network address; and

including information about the one or more internal services in the report.

23. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

progressively updating information associated with one or more metrics associated with the one or more external network addresses based on monitoring the encrypted network traffic in the one or more network segments;

progressively updating other information associated with one or more other metrics associated with the one or more internal network addresses based on monitoring the internal network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

24. The NMC of claim 19 , wherein the traffic forwarding device is one or more of a virtual private network gateway or network traffic proxy.

Assignments (2)

Continuity (3)

Cited By (10)

US 12,225,030 US 12,284,087 US 12,309,039 US 12,309,192 US 12,355,816 US 12,438,788 US 12,483,384 US 12,587,535 US 12,647,441 US 12,652,312