Back to results
US 7,444,408 B2Granted
Network data analysis and characterization model for implementation of secure enclaves within large corporate networks
AssigneeIntel Corporation, a Delaware corporation
InventorsAnand Rajavelu, Christopher J. McConnell, Ben Choi, Praveen Sampat, Haodong Wu
Life of this patent
Estimating the term…
Abstract
A database stores information about known hosts, the applications or services they host, and the ports (known as confirmed ports) used by the applications/services. A static traffic analyzer analyzes traffic data and identifies packets communicating with (either sent to or received from) confirmed ports on hosts. A dynamic traffic analyzer analyzes the traffic data and identifies packets communicating with unconfirmed ports on hosts. A host identifier uses the resulting static and dynamic traffic to identify hosts for which firewall rules should be generated.
Claims51
An apparatus to analyze traffic on a network, comprising:
- a database to store a plurality of packets forming said traffic;
- a static traffic analyzer to identify static traffic in said plurality of packets, the static traffic analyzer including:
- a static packet identifier to identify at least one static packet in said plurality of packets as said static traffic, said static packet including an address and a static port, said address identifying a static host and said static port being a confirmed port;
- a static connection identifier to identify at least one static connection to said static port on said static host in said static traffic;
- and
- a static combiner to combine all of said static connections into a static connection rollup, said static connection rollup including a number of said static connections to said static port on said static host;
- a dynamic traffic analyzer to identify dynamic traffic in said plurality of packets;
- and
- a host identifier to identify at least one host as a communication point including said static host and said static port from said static traffic and said dynamic traffic.
6 more elements
A system, comprising:
- a first network, with at least one computer coupled to the first network;
- a connection between the first network and a second network;
- and
- a traffic analyzer, including:
- a database to store a plurality of packets forming traffic crossing the connection between the first network and the second network;
- a static traffic analyzer to identify static traffic in said plurality of packets, the static traffic analyzer including:
- a static packet identifier to identify at least one static racket in said plurality of packets as said static traffic, said static packet including an address and a static port, said address identifying a static host and said static port being a confirmed port;
- a static connection identifier to identify at least one static connection to said static port on said static host in said static traffic;
- and
- a static combiner to combine all of said static connections into a static connection rollup, said static connection rollup including a number of said static connections to said static port on said static host;
- a dynamic traffic analyzer to identify dynamic traffic in said plurality of packets;
- and
- a host identifier to identify at least one host as a communication point including said static host and said static port for at least a portion of said traffic from said static traffic and dynamic traffic.
10 more elements
A method implemented in hardware for analyzing traffic on a network, comprising:
- receiving the traffic on the network as a plurality of packets;
- identifying at least one static packet in the traffic as static traffic from the plurality of packets, the static packet including an address and a static port, the address identifying a static host and the static port being a confirmed port, including:
- identifying at least one static connection to the static port on the static host in the static traffic;
- and
- combining all of the static connections into a static connection rollup, the static connection rollup including a number of the connections to the static port on the static host;
- identifying dynamic traffic from the plurality of packets;
- and
- identifying at least one port on one host in the static traffic data and the dynamic traffic data as a communication point including the static host and the static port for at least a portion of the traffic.
5 more elements
An article comprising:
- a storage medium, said storage medium having stored thereon instructions, that, when executed by a machine, result in:
- receiving the traffic on the network as a plurality of packets;
- identifying at least one static packet in the traffic as static traffic from the plurality of packets, the static packet including an address and a static port, the address identifying a static host and the static Port being a confirmed port, including:
- identifying at least one static connection to the static port on the static host in the static traffic;
- and
- combining all of the static connections into a static connection rollup, the static connection rollup including a number of the connections to the static port on the static host;
- identifying dynamic traffic from the plurality of packets;
- and
- identifying at least one port on one host in the static traffic data and the dynamic traffic data as a communication point including the static host and the static port for at least a portion of the traffic.
6 more elements
Dependencies are inferred from the claim text.