Method and system for network traffic analysis with run-time behavioral enhancements
AssigneeNetwork General Technology
InventorRobert LoPresti
Life of this patent
Estimating the term…
Abstract
A system for network traffic analysis comprises a classification engine operable to parse received frames and provide pre-analysis of the received frames to generate classification information on a flow-basis and on a per packet-basis, a filter processing engine operable to reduce the received frames based on the generated classification information to form information representing filtered frames, and an analysis block operable to perform detailed analysis on contents of the filtered frames and generate objects representing the analysis, wherein the analysis performed by the analysis block is controlled by at least one component defining a particular type of analysis performed to be on a protocol.
Claims32
A system for network traffic analysis comprising:
- a classification engine operable to parse received frames and provide pre-analysis of the received frames to generate classification information on a flow-basis and on a per packet-basis;
- a filter processing engine operable to reduce the received frames based on the generated classification information to form information representing filtered frames;
- an analysis block operable to perform detailed analysis on contents of the filtered frames and generate objects representing the analysis, wherein the analysis performed by the analysis block is controlled by at least on component defining a particular type of analysis to be performed on a protocol;
- and
- a plurality of packages, each package comprising a plurality of components and defining types of analysis that can be performed on a protocol.
A method of network traffic analysis comprising:
- performing pre-analysis of received frames to generate classification information on a flow-basis and on a per packet-basis;
- filtering the received frames to reduce the received frames based on the generated classification information to form information representing filtered frames;
- performing detailed analysis on contents of the filtered frames and generating objects representing the analysis, wherein the analysis is controlled by at least one component defining a particular type of analysis to be performed on a protocol and is further controlled by a plurality of packages, each package comprising a plurality of components and defining types of analysis that can be performed on a protocol.
A system for network traffic analysis comprising:
- a processor operable to execute computer program instructions;
- a memory operable to store computer program instructions executable by the processor;
- and
- computer program instructions stored in the memory and executable to perform the steps of:
- performing pre-analysis of received frames to generate classification information on a flow-basis and on a per packet-basis;
- filtering the received frames to reduce the received frames based on the generated classification information to form information representing filtered frames;
- performing detailed analysis on contents of the filtered frames and generating objects representing the analysis, wherein the analysis is controlled by at least one component defining a particular type of analysis to be performed on a protocol and is further controlled by a plurality of packages, each package comprising a plurality of components and defining types of analysis that can be performed on a protocol.
A computer program product of network traffic analysis comprising:
- a computer readable medium;
- computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of:
- performing pre-analysis of received frames to generate classification information on a flow-basis and on a per packet-basis;
- filtering the received frames to reduce the received frames based on the generated classification information to form information representing filtered frames;
- and
- performing detailed analysis on contents of the filtered frames and generating objects representing the analysis, wherein the analysis is controlled by at least one component defining a particular type of analysis to be performed on a protocol and is further controlled by a plurality of packages, each package comprising a plurality of components and defining types of analysis that can be performed on a protocol.
Dependencies are inferred from the claim text.