Network port profiling

A method for determining unauthorized usage of a data communication network, comprising the steps of:

• monitoring packet headers of packets exchanged between two hosts on the data communication network;
• based on the packet headers, determining the existence of a client/server (C/S) flow corresponding to a predetermined plurality of packets exchanged between the two hosts that relate to a single service and is characterized by a predetermined C/S flow characteristic;
• storing information associating a service that is associated with a determined C/S flow with at least one of the hosts that is associated with the determined C/S flow, said service comprising an observed service;
• determining hosts on the network that act as a client and server for each determined C/S flow;
• determining an allowed network services profile comprising information indicating particular network services that are authorized for use by each one of a plurality of hosts in a predefined group of hosts;
• and
• generating an alarm in response to determination that an observed network service for a particular host in the group of hosts is not included in the allowed network services profile.

A method for determining unauthorized usage of a data communication network, comprising the steps of:

• monitoring packet headers of packets exchanged between two hosts on the data communication network;
• based on the packet headers, determining the existence of a client/server (C/S) flow corresponding to a predetermined plurality of packets exchanged between the two hosts that relate to a single service and is characterized by a predetermined C/S flow characteristic;
• storing information associating a service that is associated with a determined C/S flow with at least one of the hosts that is associated with the determined C/S flow, said service comprising an observed service;
• storing an allowed network services port profile for each one of a plurality of hosts in a predefined host group, said profile including information identifying port numbers that are authorized for use by each host in the host group;
• determining the port numbers of observed network services used by each host in the predefined host group for each determined C/S flow;
• comparing the allowed network services port profile with observed network service port numbers;
• and
• generating an alarm when an observed network service port number is not included in the allowed network services port profile.

A system for determining unauthorized usage of a data communication network, comprising:

• a monitoring device including a processor operative to carry out the steps of:
• monitoring packet headers of packets exchanged between two hosts on the data communication network;
• based on the packet headers, determining the existence of a client/server C/S flow corresponding to a predetermined plurality of packets exchanged between the two hosts that relate to a single service and is characterized by a predetermined C/S flow characteristic;
• storing information associating a service that is associated with a determined C/S flow with at least one of the hosts that is associated with the determined C/S flow, said service comprising an observed service;
• determining if an observed service associated with a particular host is out of profile by comparing the service to a prestored allowed network services profile for the particular host;
• and
• in response to determination that an observed service associated with a particular host is out of profile, providing an output indicating that the observed service is out of profile.

A system for analyzing network communication traffic and determining unauthorized use, comprising:

• a processor operative to:
• a) monitor the racket headers packets on a data communication network;
• b) based on the packet headers, classify the monitored packets into client/server (C/S) flows, wherein a C/S flow corresponds to a predetermined plurality of packets exchanged between two hosts that are associated with a single service on the network;
• c) maintain a flow data structure for storing data corresponding to a plurality of C/S flows;
• d) maintain a host data structure for storing an allowed network services profile for at least one host;
• e) analyze the C/S flows in the flow data structure in order to determine if an observed service associated with a particular host is out of profile by comparing the service to the allowed network services profile for the particular host;
• and
• e) in response to determination that an observed service associated with a particular host is out of profile, providing an output indicating that the observed service is out of profile;
• a memory coupled to the processor and operative to store the flow data structure and the host data structure;
• and
• a network interface coupled to the processor operative to receive packets on the data communication network.