US 7,610,375 B2Granted

Intrusion detection in a data center environment

AssigneeCisco Technology, Inc.

InventorsMaurizio Portolani, Mauricio Arregoces, Timothy W. Stevenson

Life of this patent

Estimating the term…

Loading patent…

Abstract

An intrusion detection system (IDS) is capable of identifying the source of traffic, filtering the traffic to classify it as either safe or suspect and then applying sophisticated detection techniques such as stateful pattern recognition, protocol parsing, heuristic detection or anomaly detection either singularly or in combination based on the traffic type. In a network environment, each traffic source is provided with at least one IDS sensor that is dedicated to monitoring a specific type of traffic such as RPC, HTTP, SMTP, DNS, or others. Traffic from each traffic source is filtered to remove known safe traffic to improve efficiency and increase accuracy by keeping each IDS sensor focused on a specific traffic type.

Claims22

Dependent claims

In a network environment having a plurality of traffic sources, a system for monitoring traffic on at least a portion of said plurality of traffic sources comprising:

a plurality of intrusion detection systems;
and
a switch comprising logic that when executed is operable to:
copy traffic from each of said plurality of traffic sources;
and
redirect the copied traffic to a virtual local area network (VLAN) for intrusion detection monitoring purposes;
the VLAN comprising the switch or a second switch, either of which comprising logic that when executed is operable to:
determine a plurality of traffic types associated with the traffic, the plurality of traffic types associated with a plurality of protocol types;
filter and redirect the traffic using a redirect decision, wherein the logic operable to filter removes a first portion of the traffic from being sent to an intrusion detection system, wherein the logic to redirect is operable to:
determine a first traffic source for a second portion of traffic associated with a first set of two or more intrusion detection systems configured to monitor traffic for the first traffic source and a second traffic source for a third portion of traffic associated with a second set of one or more intrusion detection systems configured to monitor traffic for the second traffic source;
for the first traffic source, determine a first intrusion detection system (IDS) in the first set of two or more intrusion detection systems based on the determined traffic type of the second portion of traffic being sent, wherein the two or more intrusion detection systems are associated with processing different traffic types;
for the second traffic source, determine a second intrusion detection system (IDS) in the second set of one or more intrusion detection systems based on the determined traffic type of the third portion of traffic being sent;
and
redirect the second portion of traffic to the determined first intrusion detection system and the third portion of traffic to the second intrusion detection system.

11 more elements

A method comprising:

receiving, at a switch of a VLAN, copied traffic received from a plurality of traffic sources for a plurality of subnets, the copied traffic redirected to the VLAN for intrusion detection monitoring purposes;
determining a plurality of traffic types associated with the traffic, the plurality of traffic types associated with a plurality of protocol types;
determining a redirect decision to filter and redirect the traffic, wherein filtering removes a first portion of the traffic from being sent to an intrusion detection system, wherein redirecting comprises:
determining a first traffic source for a second portion of traffic associated with a first set of two or more intrusion detection systems configured to monitor traffic for the first traffic source and a second traffic source for a third portion of traffic associated with a second set of one or more intrusion detection systems configured to monitor traffic for the second traffic source;
for the first traffic source, determining a first intrusion detection system (IDS) in the first set of two or more intrusion detection systems based on the determined traffic type of the second portion of traffic being sent, wherein the two or more intrusion detection systems are associated with processing different traffic types;
for the second traffic source, determining a second intrusion detection system (IDS) in the second set of one or more intrusion detection systems based on the determined traffic type of the third portion of traffic being sent;
and
redirecting the second portion of traffic to the determined first intrusion detection system and the third portion of traffic to the second intrusion detection system.

5 more elements

An apparatus comprising:

one or more processors;
and
logic encoded in one or more tangible media for execution by the one or more processors and when executed operable to:
receive, at a switch of a VLAN, traffic received from a plurality of traffic sources for a plurality of subnets, the copied traffic redirected to the VLAN for intrusion detection monitoring purposes;
determine a plurality of traffic types associated with the traffic, the plurality of traffic types associated with a plurality of protocol types;
determine a redirect decision to filter and redirect the traffic, wherein filtering removes a first portion of the traffic from being sent to an intrusion detection system, wherein redirecting comprises:
determine a first traffic source for a second portion of traffic associated with a first set of two or more intrusion detection systems configured to monitor traffic for the first traffic source and a second traffic source for a third portion of traffic associated with a second set of one or more intrusion detection systems configured to monitor traffic for the second traffic source;
for the first traffic source, determine a first intrusion detection system (IDS) in the first set of two or more intrusion detection systems based on the determined traffic type of the second portion of traffic being sent, wherein the two or more intrusion detection systems are associated with processing different traffic types;
for the second traffic source, determine a second intrusion detection system (IDS) in the second set of one or more intrusion detection systems based on the determined traffic type of the third portion of traffic being sent;
and
redirect the second portion of traffic to the determined first intrusion detection system and the third portion of traffic to the second intrusion detection system.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/090,083Filed 25 Mar 2005 · us provisional application
Priority: 28 Oct 2004
Published: US 2006/0095968 A14 May 2006
Granted: 27 Oct 2009
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0218
Architectural arrangements, e.g. perimeter networks or demilitarized zones: distributed architectures, e.g. distributed firewalls
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection

Family

Application60/623,810Us provisional application · filed 28 Oct 2004
US 2006/0095968 A1Pre-grant publication · published 4 May 2006
US 7,610,375 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key