Session detection and inference
View Patent ↗Sessions are core components of communication between communicating systems, which may include, for example, a client device and a server. A network device can be used to monitor and analyze session information that is transmitted in a client-server communication. Visibility into the session information and the traffic flow of a network device is critical to improve the performance and security of the network device and the transmission of information in the client-server communication. A lack of visibility into the session information can reduce security, leading to viruses, malware, and malfunctions.
1. A computing system that comprises a network, a network device, a client, and a server, the computing system further comprising:
receive session information associated with a session;
record the session information;
determine a type of the session, wherein:
the type of the session is long-lived if the session time duration is greater than a duration threshold; or
the type of the session is short-lived;
categorize the session into a session group of session groups based on the session information;
analyze the session information based on the categorized session group of the session;
determine a frequency of short-lived sessions within a set period;
determine a frequency of long-lived sessions with a set period;
determine a mean frequency based on the frequency of short-lived sessions and the frequency of long-lived sessions;
determine anomalous behavior between the sessions in a session group; and
send an alert of the determined anomalous behavior
perform load balancing on the session based on the analysis and categorization of the session, wherein the load balancing comprises staggering a transmission of frames or packets within sessions such that at any given interval of time, a total amount of traffic transmitted across all the session is within a threshold amount of traffic.
2. The computing system of claim 1 , wherein the session information comprises a source IP, destination IP, source port, destination port, session start time, session time duration, session count, and length of frame of the session information.
3. The computing system of claim 1 , further comprising:
rank the short-lived and the long-lived sessions for load balancing.
4. The computing system of claim 1 , wherein the determining anomalous behavior between the sessions in a session group further comprises:
determine that the frequency of short-lived sessions is at least two times greater than the mean frequency; and
determine that the frequency of long-lived sessions is at least two times less than the mean frequency.
5. The computing system of claim 1 , wherein the analyzing the session information further comprises:
compare session information of a plurality of sessions in the categorized session group;
determine, based on the compared session information, anomalous behavior between the sessions in the categorized session group; and
send an alert of the determined anomalous behavior.