Method and system for diagnosing network intrusion
AssigneeIntel Corporation
InventorsRajenda Yavatkar, David M. Putzolu
Life of this patent
Estimating the term…
Abstract
A method and system are disclosed for analyzing traffic on a network by monitoring network traffic and, when a particular network condition (for example, a network attack) is detected, gathering information about the traffic on the network by launching an agent and having the agent iteratively identify which of the links on the node on which the agent operates accepts a type or class of traffic, traverse the identified link to the node across the link, and repeat the process.
Claims25
A method for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the method comprising:
- at at least a first node on the network monitoring traffic;
- and
- if a particular network condition is detected, gathering information about the traffic on the network using an agent which:
- identifies which of the links on the node on which the agent operates accepts a class of traffic;
- and
- traverses the link to the node across the link.
A method for analyzing a network, the network comprising nodes, each node connecting to a set of links, the method comprising:
- at at least a first node on the network monitoring for an attack condition;
- and
- at the first node, when an attack condition is detected, determining a set of traffic suspected to be attack traffic and launching an agent, the agent recording information about traffic by:
- detecting which among the links of the node at which the agent currently operates is receiving the most of a subset of the set of traffic suspected to be attack traffic;
- selecting a link found to be receiving the most of the subset of the set of traffic suspected to be attack traffic and recording the identity of the selected link;
- and
- attempting to move to the node connected to the selected.
A system for analyzing traffic on a network, the network comprising nodes, each node having a set of links, the system comprising:
- an agent of to:
- identify which of the links on the node on which the agent operates accepts attack traffic;
- and
- traverse the link to the node across the link;
- and
- a module to monitor network traffic, and, when if an attack condition is detected, to gather information about traffic on the network by launching the agent.
A set of instructions residing in a storage medium, said set of instructions capable of being executed by a processor to implement a method for analyzing attack traffic a network, the network comprising nodes, each node connecting to a set of links, the method comprising:
- monitoring traffic at at least a first node on the network;
- and
- if an attack condition is detected, gathering information about the traffic on the network by having an agent repeatedly:
- identify which of the links on the node on which the agent operates accepts attack traffic;
- and
- traversing traverse the link to the node across the link.
Dependencies are inferred from the claim text.