Dual-port mirroring system for analyzing non-stationary data in a network
Distinct sets of non-stationary data seen on a switch in data communication with one or more of computerized units in a network, are mirrored via two switch ports, which include a first port and a second port. A dual analysis is performed while mirroring said distinct sets of data. First data obtained from data mirrored at the first port are analyzed (e.g., using a trained machine learning model) and, based on the first data analyzed, the switch is reconfigured for the second port to mirror second data, which are selected from non-stationary data as seen on the switch (e.g., data received and/or transmitted by the switch). The second data mirrored at the second port is analyzed (e.g., using a different analysis scheme, suited for the selected data).
1. A method of analyzing non-stationary data in a network of computerized units, wherein the network further comprises a switch in data communication with one or more of said computerized units, wherein the method comprises:
aggregating, by the switch, data received via input ports of the switch;
mirroring distinct sets of the data via two switch ports that comprise a first port and a second port, the first port mirroring the aggregated data and the second port mirroring the data selectively according to the second port's latest configuration, the mirroring via the first port and via the second port being performed concurrently; and
while mirroring said distinct sets of the data:
analyzing first data obtained from data mirrored at the first port;
based on the first data analyzed, reconfiguring the switch for the second port to mirror second data selected from data communicated via the switch; and
analyzing the second data mirrored at the second port.
2. The method according to claim 1 , wherein
said first data and said second data are analyzed using distinct analysis schemes, the latter including a first analysis scheme for analyzing said first data and a second analysis scheme for analyzing said second data.
3. The method according to claim 2 , wherein
analyzing said first data comprises implementing a trained machine-learning model as part of said first analysis scheme, wherein said machine-learning model is run to identify specific data characteristics from the first data analyzed, whereby, at reconfiguring the switch, the switch is reconfigured for the second port to selectively mirror said second data based on the specific data characteristics identified.
4. The method according to claim 3 , wherein
data mirrored at the first port comprises network traffic data received by the switch.
5. The method according to claim 4 , wherein
the aggregating comprises aggregating network traffic data, which are then mirrored at the first port to obtain said first data.
6. The method according to claim 5 , wherein
aggregating network traffic data comprises aggregating network traffic data received from all input ports of the switch.
7. The method according to claim 5 , wherein
said machine-learning model is trained to identify anomalous sources of network traffic from said network traffic data, whereby, at reconfiguring the switch, the switch is reconfigured for the second port to selectively mirror data received by the switch from the anomalous sources identified, as said second data.
8. The method according to claim 7 , wherein
analyzing said second data comprises implementing a deep packet inspection of data packets in said second data, as part of said second analysis scheme.
9. The method according to claim 1 , wherein
reconfiguring the switch comprises generating selections rules based on the first data analyzed, for the switch to select said second data to be mirrored at the second port according to one or more of the generated rules.
10. The method according to claim 9 , wherein
generating said selections rules comprises generating an access control list to match and mirror said second data.
11. A dual-port mirroring system for analyzing non-stationary data in a network of computerized units, the system comprising:
a switch, configured to enable data communication with one or more of the computerized units of the network;
an observing entity, connected to two ports, comprising a first port and a second port, wherein the two ports are configured, together with the switch, to mirror distinct sets of data communicated via the switch, the first port mirroring aggregated data received via input ports of the switch, and the second port mirroring the data selectively according to the second port's latest configuration, wherein the first port and the second port are configured to mirror the distinct sets of data concurrently; and
a data analyzer, in data communication with the observing entity and configured to:
analyze first data obtained from data mirrored at the first port;
based on the first data analyzed, reconfigure the switch for the second port to mirror second data selected from data communicated via the switch; and
analyze the second data mirrored at the second port.
12. The system according to claim 11 , wherein
the data analyzer is further configured to implement distinct analysis schemes, including a first analysis scheme for analyzing said first data and a second analysis scheme for analyzing said second data.
13. The system according to claim 12 , wherein
the data analyzer is configured to implement a trained machine-learning model as part of said first analysis scheme, whereby:
said machine-learning model is run to identify specific data characteristics from the first data analyzed; and
the data analyzer is adapted to reconfigure the switch for the second port to selectively mirror said second data based on the specific data characteristics identified, in operation.
14. The system according to claim 13 , wherein
the first port is configured, together with the switch, to mirror network traffic data received by the switch, said first data comprising said network traffic data, in operation.
15. The system according to claim 13 , wherein
said machine-learning model is trained to identify anomalous sources of network traffic from said network traffic data, whereby the data analyzer is adapted to reconfigure the switch for the second port to selectively mirror data received by the switch from the anomalous sources identified, as said second data, in operation.
16. The system according to claim 15 , wherein
the data analyzer is further configured to implement a deep packet inspection as part of said second analysis scheme.
17. The system according to claim 11 , wherein
the data analyzer is further configured to generate selections rules based on the first data analyzed, for the switch to select said second data to be mirrored at the second port based on traffic matching one or more of the generated rules.
18. The system according to claim 11 , wherein
said two ports are configured as output ports of said switch.
19. A computer program product for analyzing non-stationary data in a network of computerized units, wherein the network further comprises:
a switch in data communication with one or more of said computerized units; and
an observing entity, connected to two ports, comprising a first port and a second port, wherein the two ports are configured, together with the switch, to mirror distinct sets of data communicated via the switch, the first port mirroring aggregated data received via input ports of the switch, and the second port mirroring the data selectively according to the second port's latest configuration, wherein the first port and the second port are configured to mirror the distinct sets of data concurrently,
and wherein the computer program product comprises
a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors, to cause, while mirroring said distinct sets of data, to:
analyze first data obtained from data mirrored at the first port;
based on the first data analyzed, reconfigure the switch for the second port to mirror second data selected from data communicated via the switch; and
analyze the second data mirrored at the second port.
20. The computer program product according to claim 19 , wherein
said program instructions are further executable for said first data and said second data to be analyzed using distinct analysis schemes, the latter including a first analysis scheme for analyzing said first data and a second analysis scheme for analyzing said second data, wherein analyzing said first data comprises implementing a machine-learning model as part of said first analysis scheme, wherein said machine-learning model is trained to identify specific data characteristics from the first data analyzed, whereby, upon reconfiguring the switch, the switch is reconfigured for the second port to selectively mirror said second data based on the specific data characteristics identified.