# US 11,121,918 B2 · Intelligent network management device and method of managing network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,918 B2 - Document ID: US11121918B2 - Status: Granted - Kind: B2 - Application number: 15/805,193 - Filed: 2017-11-07 - Published: 2018-03-15 - Granted: 2021-09-14 - Earliest claimed: 2014-07-31 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Chih-Wen Chao; Cheng-Ta Lee; Wei-Shiau Suen; Ming-Hsun Wu - Web page: https://patentgrep.com/patent/US11121918B2 ## CPC - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 47/115: {using a dedicated packet} - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An intelligent network management device including an analytic unit, conducting an analysis according to received packets in order to determine whether a given event is occurred; and a processing unit, generating and sending a control instruction to a SDN controller to change configurations of a SDN switch when the analytic unit determined the given event has been occurred. ## Claims ### Claim 1 An intelligent network management device, disposed in a software-defined network (SDN) and connected to a SDN switch and connected to a SDN controller configured to control the SDN switch via a flow table of the SDN switch, the intelligent network management device comprising an analytic unit portion and a processing unit portion, wherein: the analytic unit portion of the intelligent network management device is configured to conduct an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notify the processing unit portion of the intelligent network management device when the given event is determined to have occurred; and the processing unit portion of the intelligent network management device is configured to generate and send an instruction to the SDN controller to change configurations of the SDN switch flow table of the SDN switch when the analytic unit portion of the intelligent network management device determines that the given event has occurred. ### Claim 2 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the intelligent network management device is an intrusion prevention system (IPS) device. ### Claim 3 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the configurations maintained within the SDN switch are changed by the SDN controller as instructed by the intelligent network management device so that the SDN switch at least affects subsequent network flow to the intelligent network management device in the SDN. ### Claim 4 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the configurations of the SDN switch are changed so that the SDN switch at least affects subsequent packets sent to the intelligent network management device in the SDN. ### Claim 5 (depends on 4) The intelligent network management device as claimed in claim 4, wherein the given event is an attack event and the SDN switch accordingly blocks packets from a source of the attack event from being further sent to the intelligent network management device. ### Claim 6 (depends on 4) The intelligent network management device as claimed in claim 4, wherein the given event determined by the analytic unit portion of the intelligent network management device is an unanalyzable-packet event and the configuration of the SDN switch is changed by the SDN controller such that the SDN switch accordingly stops sending packets unanalyzable by the intelligent network management device to the intelligent network management device. ### Claim 7 (depends on 4) The intelligent network management device as claimed in claim 4, wherein the given event determined by the analytic unit portion of the intelligent network management device is an unanalyzable-packet event and the configuration of the SDN switch is changed by the SDN controller such that the SDN switch accordingly sends packets unanalyzable by the intelligent network management device to a pre-processing device to be converted into packets analyzable by the intelligent network management device. ### Claim 8 (depends on 6) The intelligent network management device as claimed in claim 6, wherein the packets unanalyzable by the intelligent network management device are encrypted, and wherein the configuration of the SDN switch is changed by the SDN controller such that the SDN switch sends the packets that are encrypted to an appliance for pre-processing. ### Claim 9 A network management method, used in an intelligent network management device comprising an analytic unit configured to conduct an analysis according to packets received by the intelligent network management device via a software-defined network (SDN) switch to determine whether a given event has occurred; and a processing unit configured to generate and send an instruction to an SDN controller operatively coupled to both the intelligent network management device and the SDN switch and configured to change configurations of a flow table of the SDN switch when the analytic unit determines that the given event has occurred, the method comprising: conducting the analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred and notifying the processing unit when the given event is determined to have occurred; and generating and sending an instruction to the SDN controller to change configurations of the SDN switch flow table of the SDN switch when the analytic unit determines that the given event has occurred. ### Claim 10 A network management method, adopted by an intelligent network management device disposed in a software-defined network (SDN) and connected to a SDN switch and a SDN controller used to control the SDN switch via a flow table of the SDN switch, the method comprising: conducting an analysis according to packets received by the intelligent network management device via the SDN switch to determine whether a given event has occurred; further determining whether the given event is preferred to be handled by the SDN controller when the given event is determined to have occurred; and generating and sending an instruction to the SDN controller to change configurations of the SDN switch flow table of the SDN switch when the given event is determined to be preferred to be handled by the SDN controller. ### Claim 11 (depends on 9) A computer program product comprising a non-transitory computer usable storage device having program code embodied thereon that is configured to perform, when executed by a data processor, the method of claim 9. ### Claim 12 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the instruction is an instruction to change configurations of the SDN switch to block subsequent attack packets, and wherein the processing unit portion of the intelligent network management device sends the instruction to the SDN switch instructing the SDN switch to block the subsequent attack packets. ### Claim 13 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the intelligent network management device is configured to block packets received from the SDN switch. ### Claim 14 (depends on 1) The intelligent network management device as claimed in claim 1, wherein the intelligent network management device and the SDN switch are operatively coupled to an appliance. ### Claim 15 (depends on 14) The intelligent network management device as claimed in claim 14, wherein the intelligent network management device is configured to receive decrypted packets decrypted by the appliance. ### Claim 16 (depends on 8) The intelligent network management device as claimed in claim 8, wherein the intelligent network management device is configured to receive decrypted packets decrypted by the appliance.