Back to results
US 8,079,083 B1Granted
Method and system for recording network traffic and predicting potential security events
AssigneeSymantec Corporation
InventorsJeremy Bennett, Carl Alexander Adams
Life of this patent
Estimating the term…
Abstract
Recording network traffic is disclosed. Data associated with a network flow are monitored. If it is determined that the data associated with the network flow satisfy a first criterion based at least in part on a prediction value that reflects a likelihood that the network flow will result in a security event, the data associated with the network flow are begun to be recorded even though a second criterion corresponding to the security event has not been satisfied.
Claims16
A method for storing network traffic, comprising:
- using at least one processor to monitor network traffic;
- determining if the network traffic satisfies a first criterion, wherein determining if the network traffic satisfies a first criterion includes:
- identifying a plurality of probabilities by applying the network traffic to a state graph that comprises a plurality of states, wherein each of the plurality of probabilities indicates a likelihood that the network traffic is associated with a security event and each of the plurality of probabilities is associated with a corresponding one of the plurality of states;
- combining the plurality of probabilities to generate a combined probability that indicates the likelihood that the network traffic is associated with the security event, wherein combining the plurality of probabilities comprises summing the plurality of probabilities;
- and
- determining whether the combined probability exceeds a predetermined threshold;
- storing the network traffic in a first storage location until it is determined that the first criterion has been satisfied;
- and
- storing, in a second storage location, the network traffic stored in the first storage location and at least subsequent network traffic based on a determination that the first criterion has been satisfied and even though a second criterion corresponding to the security event has not been satisfied and the security event has not yet occurred, wherein the network traffic with a highest combined probability of resulting in the security event in the first storage location is stored first in the second storage location.
6 more elements
A system for storing network traffic, comprising:
- a processor configured to:
- monitor network traffic;
- determine if the network traffic satisfies a first criterion, wherein the processor is configured to determine if the network traffic satisfies a first criterion by:
- identifying a plurality of probabilities by applying the network traffic to a state graph that comprises a plurality of states, wherein each of the plurality of probabilities indicates a likelihood that the network traffic is associated with a security event and each of the plurality of probabilities is associated with a corresponding one of the plurality of states;
- combining the plurality of probabilities to generate a combined probability that indicates the likelihood that the network traffic is associated with the security event, wherein combining the plurality of probabilities comprises summing the plurality of probabilities;
- and
- determining whether the combined probability exceeds a predetermined threshold;
- store the network traffic in a first storage location until it is determined that the first criterion has been satisfied;
- and
- store, in a second storage location, the network traffic stored in the first storage location and at least subsequent network traffic based on a determination that the first criterion has been satisfied and even though a second criterion corresponding to the security event has not been satisfied and the security event has not yet occurred, wherein the network traffic with a highest combined probability of resulting in the security event in the first storage location is stored first in the second storage location;
- and
- a memory coupled with the processor, wherein the memory provides the processor with instructions.
9 more elements
A computer program product for storing network traffic, the computer program product comprising a non-transitory computer readable storage medium having computer instructions encoded thereon which when executed by a computer cause the computer to perform the steps of:
- monitoring network traffic;
- determining if the network traffic satisfies a first criterion, wherein determining if the network traffic satisfies a first criterion includes:
- identifying a plurality of probabilities by applying the network traffic to a state graph that comprises a plurality of states, wherein each of the plurality of probabilities indicates a likelihood that the network traffic is associated with a security event and each of the plurality of probabilities is associated with a corresponding one of the plurality of states;
- combining the plurality of probabilities to generate a combined probability that indicates the likelihood that the network traffic is associated with the security event, wherein combining the plurality of probabilities comprises summing the plurality of probabilities;
- and
- determining whether the combined probability exceeds a predetermined threshold;
- storing the network traffic in a first storage location until it is determined that the first criterion has been satisfied;
- and
- storing, in a second storage location, the network traffic stored in the first storage location and at least subsequent network traffic based on a determination that the first criterion has been satisfied and even though a second criterion corresponding to the security event has not been satisfied and the security event has not yet occurred, wherein the network traffic with a highest combined probability of resulting in the security event in the first storage location is stored first in the second storage location.
6 more elements
A system for storing network traffic, comprising:
- a monitoring computing apparatus configured to monitor network traffic;
- a determination computing apparatus configured to determine if the network traffic satisfies a first criterion, wherein determining if the network traffic satisfies a first criterion includes:
- identifying a plurality of probabilities by applying the network traffic to a state graph that comprises a plurality of states, wherein each of the plurality of probabilities indicates a likelihood that the network traffic is associated with a security event and each of the plurality of probabilities is associated with a corresponding one of the plurality of states;
- combining the plurality of probabilities to generate a combined probability that indicates the likelihood that the network traffic is associated with the security event, wherein combining the plurality of probabilities comprises summing the plurality of probabilities;
- and
- determining whether the combined probability exceeds a predetermined threshold;
- a storing computing apparatus configured to store the network traffic in a first storage location until it is determined that the first criterion has been satisfied;
- and
- a storing computing apparatus configured to store, in a second storage location, the network traffic stored in the first storage location and at least subsequent network traffic based on a determination that the first criterion has been satisfied and even though a second criterion corresponding to a security event has not been satisfied and the security event has not yet occurred, wherein the network traffic with a highest combined probability of resulting in the security event in the first storage location is stored first in the second storage location.
6 more elements
Dependencies are inferred from the claim text.