US 6,418,467 B1 · Network accounting and billing system and method

Abstract

In some embodiments, network traffic information is captured at network information sources. These sources provide detailed information about the network communications transactions at a network device. Importantly, different types of sources can provide different types of information. Gatherer devices gather the detailed information from the various information source devices and convert the information into standardized information. The gatherer devices can correlate the gathered information with account information for network transaction accounting. Manager devices manage the gatherer devices and store the gathered standardized information. The manager devices eliminate duplicate network information that may exist in the standardized information. The manager devices also consolidate the information. Importantly, the information stored by the manager devices represents the consolidated, account correlated, network transaction information that can be used for billing or network accounting. The system thereby provides a distributed network accounting and billing system.

A method for billing and charging for network usage, comprising:

(a) collecting network communications usage information in real-time from network devices at a plurality of layers utilizing multiple gatherers each including a plurality of information source modules each interfacing with one of the network devices and capable of communicating using a protocol specific to the network device coupled thereto, the network devices selected from the group consisting of routers, switches, firewalls, authentication servers, web hosts, proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name servers, the gatherers being positioned on a segment of the network on which the network devices coupled thereto are positioned for minimizing an impact of the gatherers on the network;
(b) translating the network communications usage information collected from the network devices utilizing the information source modules;
(c) caching the network communications usage information collected from the network devices utilizing the gatherers;
(d) normalizing the network communications usage information with the gatherers by excluding fields not required by a central event manager coupled to the gatherers;
(e) defining an enhancement procedure utilizing the central event manager by:
(i) accessing the central event manager,
(ii) naming the enhancement procedure,
(iii) selecting a trigger for the enhancement procedure, the trigger corresponding to at least one of the information source modules,
(iv) identifying a field type to be enhanced,
(v) listing a plurality of fields that match the field type to be enhanced,
(vi) listing a plurality of functions available based on the information source module corresponding to the trigger,
(vii) allowing the user to choose at least one of the listed fields, and
(viii) allowing a user to choose at least one of the listed functions;
(f) displaying the enhancement procedure on a graphical user interface by representing each function as a separate graphical representation, wherein the graphical representations are shown to be joined to each other in accordance with the enhancement procedure;
(g) coordinating the collection of the network communications usage information by the gatherers utilizing the central event manager;
(h) filtering the network communications usage information utilizing the central event manager;
(i) aggregating the network communications usage information and the data records utilizing the central event manager for reducing a number of the data records;
(j) enhancing the aggregation in accordance with the defined enhancement procedure, the enhancement including:
(i) receiving the network communications usage information,
(ii) determining whether the trigger has occurred,
(iii) if the trigger has occurred, applying the at least one chosen function associated with the enhancement procedure to the network communications usage information,
(iv) identifying results of the function,
(v) using the results of the function to gather additional network communications usage information from other gatherers, and
(vi) enhancing the chosen field with the additional network communications usage information;
(k) completing a plurality of data records from the filtered network communications usage information by accessing user account information, and determining for each data record a corresponding source IP address, a corresponding domain name, a corresponding type of service used, and a corresponding amount of time that the service was used, the plurality of data records corresponding to network usage by a plurality of users;
(l) merging duplicate records in the plurality of data records for enhancing efficiency;
(m) billing the users based on the data records;
(n) time stamping the data records;
(o) storing the time stamped data records in tables in a central database coupled to the central event manager at a user-specified interval;
(p) deleting the stored data records upon the cessation of a predetermined amount of time after the storage utilizing the timestamp;
(q) periodically determining whether the network devices are currently licensed;
(r) submitting network activity queries to the central database for retrieving information on activity of the network;
(s) outputting a network activity report based on the network activity queries;
(t) submitting resource consumption queries to the central database for retrieving information on resource consumption in the network;
(u) outputting a resource consumption report based on the resource consumption queries;
(v) continuously monitoring a state of the gatherers;
(w) detecting a fault;
(x) utilizing the state of the gatherers and the stored data records to recover from the fault upon the detection thereof;
(y) generating an alert upon the occurrence of an event utilizing the information source modules;
(z) wherein the data records are in a data record format having a plurality of fields including a source IP field, a destination IP field, a source host field, a destination host field, a service type field, a date and time field, a duration field, a total number of bytes field, and a counter field.

37 more elements

Network accounting and billing system and method

Life of this patent

Network accounting and billing system and method

Life of this patent

Abstract

Claims1