# US 12,113,697 B2 · System and method for determining flow specification efficacy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,697 B2 - Document ID: US12113697B2 - Status: Granted - Kind: B2 - Application number: 17/970,364 - Filed: 2022-10-20 - Published: 2024-04-25 - Granted: 2024-10-08 - Earliest claimed: 2022-10-20 - Assignees: Arbor Networks, Inc. - Applicants: Arbor Networks, Inc. - Inventors: Michael Ratanatharathorn; Kyle Oswald; Anthony Powell; Joel Harrison - Web page: https://patentgrep.com/patent/US12113697B2 ## CPC - H04L 43/50: Testing arrangements - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer implemented method and system for simulating the effect of one or more flow specification rules upon archived network flow data. Archived network flow data is retrieved from a database that was exported from a network device. One or more flow specification rules are applied to the archived network flow data, wherein the one or more flow specification rules are configured to perform one or more flow specification actions on the archived network flow data. Determined are one or more flow actions affected on the archived network flow data by the applied one or more flow specification rules. Indication/notification of the determined one or more flow actions are provided. ## Claims ### Claim 1 A computer implemented method comprising: receiving, via a user interface, a first query of a storage device coupled to an external network; retrieving, by a network monitoring device disposed between the external network and a protected network, stored external network data, exported from the external network and aimed at the protected network, from the storage device; applying, by the network monitoring device, one or more flow specification rules to the retrieved stored external network data, wherein the one or more flow specification rules are configured to perform one or more flow specification actions on the retrieved stored external network data, wherein each of the one or more flow specification actions corresponds to performing, on the stored external network data, dropping, rate-limiting, traffic accepting, or passing of network traffic; finding, by the network monitoring device, a match of one of the one or more flow specification rules using a matching criteria; determining, by the network monitoring device, network traffic activity corresponding to the matched one of the one or more flow specification rules; identifying, by the network monitoring device, data from the determined network traffic activity that is respectively dropped, limited, passed, or accepted based on the flow specification actions corresponding to the matched one or more flow specification rules; and generating, by the network monitoring device based on the identified data, a user interface comprising a plurality of lists of ports of external network devices, each list corresponding to a different flow specification action and comprising a plurality of ports of external network devices ordered based on an amount of network traffic impacted by the flow specification action of the list. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein the matching criteria includes source and destination information. ### Claim 3 (depends on 2) The computer implemented method of claim 2, wherein the source and destination information includes address prefixes, IP protocol, and transport protocol port numbers. ### Claim 4 (depends on 1) The computer implemented method of claim 1, wherein the retrieved stored external network data is in at least one of the following formats: Netflow; IPIX; and sFlow. ### Claim 5 (depends on 1) The computer implemented method of claim 1, further comprising building, based on the received first query, a request for stored external network data during a specified time period. ### Claim 6 (depends on 1) The computer implemented method of claim 1, wherein the one or more flow specification rules are progressively applied to the retrieved stored external network data. ### Claim 7 (depends on 1) The computer implemented method of claim 1, wherein responsive to the one or more flow specification rules matching the retrieved stored external network data, one or more flow actions on the retrieved stored external network data are determined. ### Claim 8 (depends on 7) The computer implemented method of claim 7, wherein further responsive to the one or more flow specification rules matching the retrieved stored external network data, an index for each of the one or more specification rules is identified. ### Claim 9 (depends on 8) The computer implemented method of claim 8, wherein the determined one or more flow actions and the one or more identified indexes associated with the one or more flow specification rules matching the retrieved stored external network data are displayed to a user. ### Claim 10 (depends on 1) The computer implemented method of claim 1, further including displaying the one or more flow specification rules. ### Claim 11 (depends on 1) The computer implemented method as recited in claim 1, wherein the one or more flow specification rules are configured to affect a change to the external network data flowing through at least one network device. ### Claim 12 (depends on 1) The computer implemented method of claim 1, further including detecting a network attack in the network traffic activity. ### Claim 13 (depends on 1) The computer implemented method of claim 1, wherein the applied one or more flow specification rules are selected from a database of preconfigured specification rules. ### Claim 14 A network monitoring device, comprising: one or more databases storing external network data exported from a plurality of external network devices coupled to an external network aimed at a protected network; a processor disposed between the external network and the protected network in communication with memory configured to store instructions, wherein the processor upon execution of the instructions is configured to: receive, via a first user interface, a first query of the one or more databases storing the external network data; retrieve the stored external network data from the one or more databases in response to receipt of the first query; apply one or more flow specification rules to the retrieved stored external network data, wherein the one or more flow specification rules are configured to perform one or more flow specification actions on the retrieved stored external network data, wherein each of the one or more flow specification actions corresponds to performing, on the stored external network data, dropping, rate-limiting, traffic accepting, or passing of network traffic; find a match of one of the one or more flow specification rules using a matching criteria; determine network traffic activity corresponding to the matched one of the one or more flow specification rules; identify data from the determined network traffic activity that is respectively dropped, limited, passed or accepted based on the flow specification actions corresponding to the matched one or more flow specification rules; and generating, by the network monitoring device based on the identified data, a user interface comprising a plurality of lists of ports of external network devices, each list corresponding to a different flow specification action and comprising a plurality of ports of external network devices ordered based on an amount of network traffic impacted by the flow specification action of the list. ### Claim 15 (depends on 14) The network device of claim 14, wherein the processor is further configured to: monitor the external network data flowing through one or more networks; and detect a network attack in the network data to the one or more networks. ### Claim 16 (depends on 14) The network device of claim 14, wherein the one or more flow specification rules are selected from a plurality of preconfigured specification rules stored in the one or more databases. ### Claim 17 (depends on 14) The network device of claim 14, wherein the one or more announced flow specification rules are configured and operative to mitigate a network attack. ### Claim 18 (depends on 14) The network device of claim 14, wherein retrieving the network data further includes retrieving captured external network data corresponding to a user defined time period. ### Claim 19 (depends on 14) The network device of claim 14, wherein the one or more flow specification rules are progressively applied to the retrieved captured external network data.