# US 10,374,918 B2 · Method and system for configuring behavioral network intelligence system using network monitoring programming language > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,918 B2 - Document ID: US10374918B2 - Status: Granted - Kind: B2 - Application number: 14/560,872 - Filed: 2014-12-04 - Published: 2015-06-04 - Granted: 2019-08-06 - Earliest claimed: 2013-12-04 - Assignees: Radware, Ltd. - Applicants: Radware, Ltd. - Inventors: Lev Medvedovsky; David Aviv; Avi Chesla - Web page: https://patentgrep.com/patent/US10374918B2 ## CPC - H04L 41/16: using machine learning or artificial intelligence - G06N 5/02: Knowledge representation; Symbolic representation - G06N 5/025: Extracting rules from data - G06N 5/04: Inference or reasoning models - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/0894: Packet rate - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method and system for configuring a behavioral network intelligence system using a network monitoring programming language are provided. The method includes defining at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined respective of an application path keyword and an application path assessment keyword; and defining at least one condition representing the behavior of the at least one application path attribute of the application, the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network. ## Claims ### Claim 1 A method for configuring a behavioral network intelligence system using a network monitoring programming language, comprising: defining at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined for an application path keyword and an application path assessment keyword; defining at least one condition representing the behavior of the at least one application path attribute of the application, wherein the at least one condition is defined using a plurality of terms and Boolean expressions, each of the plurality of terms is defined for a behavior keyword and a behavior keyword assessment; parsing the at least one target and the at least one condition to generate a list of entities; and instantiating a plurality of inference modules based on the parsing of the at least one target and the at least one condition; wherein the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network carrier. ### Claim 2 The method of claim of 1, wherein the at least one application path attribute and the at least one condition comply with a syntax of the network monitoring programming language. ### Claim 3 (depends on 2) The method of claim 2, wherein the behavior keyword, the behavior keyword assessment, the application path keyword, and the application path assessment keyword are defined by the syntax of the network monitoring programming language. ### Claim 4 (depends on 2) The method of claim 2, wherein the behavior keyword assessment is any one of: high, low, and normal. ### Claim 5 (depends on 2) The method of claim 2, wherein the application path keyword assessment is any one of: a specific number, a specific label, a list of numbers, a list of labels, ‘all’, and ‘any’. ### Claim 6 (depends on 2) The method of claim 2, wherein the application path keyword relates to an application path attribute including any one of: an application name, a device type, an operating system type, an operating system version, a geographical location, a browser type, an application type, and an application version. ### Claim 7 (depends on 2) The method of claim 2, wherein the behavior keyword relates to a behavioral parameter including any one of: a packet rate, a byte rate, a data direction, a plurality of new connections per second (CPS), a concurrent number of connections per application (CUC), a connection duration, and a transport protocol state. ### Claim 8 (depends on 1) The method of claim 1, further comprising: evaluating using the inference modules at least a degree of fulfillment (DoF), wherein the DoF defines a behavior group that the plurality of terms satisfy with respect to the at least one target. ### Claim 9 (depends on 8) The method of claim 8, wherein evaluating the at least a DoF further comprises: for each of the plurality terms: sampling, at predefined time intervals, data of behavioral parameters related to behavior keywords defined in the term; computing behavioral scores using the sampled data and the behavior keyword assessment; and correlating the computed behavioral scores using the plurality of terms and Boolean expressions to generate the at least one DoF. ### Claim 10 (depends on 8) The method of claim 8, wherein the behavior group defines any one of: variance of chatty activity, variance of malware activity, and variance of scanning activity. ### Claim 11 (depends on 1) The method of claim 1, wherein the at least one condition is dynamically changed. ### Claim 12 (depends on 1) The method of claim 1, wherein the network monitoring programming language is a human linguistics programming language. ### Claim 13 (depends on 1) The method of claim 1, wherein the method is implemented in a central controller of a software defined network (SDN), wherein the SDN further comprises a plurality of network elements, and wherein the SDN is part of an infrastructure of a network carrier. ### Claim 14 (depends on 1) A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1. ### Claim 15 A system for determining the behavioral impact of applications on a network, comprising: a processor; and a memory communicatively connected to the processor, the memory containing a plurality of instructions that, when executed by the processor, configure the system to: define at least one target of a traffic segment to be monitored using at least one application path attribute of an application, wherein the application is accessed via at least one user device connected to a network, wherein the at least one application path attribute is defined for an application path keyword and an application path assessment keyword; define at least one condition representing the behavior of the at least one application path attribute of the application, wherein the at least one condition is defined using a plurality of terms and Boolean expressions, each of the plurality of terms is defined for a behavior keyword and a behavior keyword assessment; parse the at least one target and the at least one condition to generate a list of entities; and instantiate a plurality of inference modules based on the parsing of the at least one target and the at least one condition; wherein the at least one target and the at least one condition can be interpreted by a monitoring system to allow for determining a behavioral impact of the application on the network. ### Claim 16 The system of claim of 15, wherein the at least one application path attribute and the at least one condition comply with a syntax of the network monitoring programming language. ### Claim 17 (depends on 16) The system of claim 16, wherein the behavior keyword, the behavior keyword assessment, the application path keyword, and the application path assessment keyword are reserved words of the network monitoring programming language. ### Claim 18 (depends on 16) The system of claim 16, wherein the behavior keyword assessment is any one of: high, low, and normal. ### Claim 19 (depends on 16) The system of claim 16, wherein the application path keyword assessment is any one of: a specific number, a specific label, a list of numbers, a list of labels, ‘all’, and ‘any’. ### Claim 20 (depends on 16) The system of claim 16, wherein the application path keyword relates to an application path attribute including any one of: an application name, a device type, an operating system type, an operating system version, a geographical location, a browser type, an application type, and an application version. ### Claim 21 (depends on 16) The system of claim 16, wherein the behavior keyword relates to a behavioral parameter including any one of: a packet rate, a byte rate, a data direction, a plurality of new connections per second (CPS), a concurrent number of connections per application (CUC), a connection duration, and a transport protocol state. ### Claim 22 (depends on 15) The system of claim 15, wherein the system is further configured to: evaluate, using the interference modules, at least a degree of fulfillment (DoF), wherein the DoF defines a behavior group that the plurality of terms satisfy with respect to the at least one target. ### Claim 23 (depends on 22) The system of claim 22, wherein the system is further configured to: for each of the plurality terms: sample, at predefined time intervals, data of behavioral parameters related to behavior keywords defined in the term; and compute behavioral scores using the sampled data and the behavior keyword assessment, correlate the computed behavioral scores using the plurality of terms and Boolean expressions to generate the at least one DoF. ### Claim 24 (depends on 22) The system of claim 22, wherein the behavior group defines any one of: variance of chatty activity, variance of malware activity, and variance of scanning activity. ### Claim 25 (depends on 15) The system of claim 15, wherein the at least one condition is dynamically changed. ### Claim 26 (depends on 15) The system of claim 15, wherein the network monitoring programming language is a human linguistics programming language.