Back to results
US 9,794,272 B2Granted
Method and apparatus for monitoring malicious traffic in communication networks
AssigneeAlcatel Lucent
InventorsLyle Strub, Adrian Grah, Bashar Said Bou-Diab
Life of this patent
Estimating the term…
Abstract
A method and apparatus for monitoring data traffic in a communication network are provided. A router connected to the communication network monitors information contained in the data traffic, and based on the information determines whether data in the traffic is indicative of a malicious threat to one or more resources connected to the network. Parameters which control monitoring of traffic at the router, such as the sampling rate and what information is to be extracted from the data is varied according to the condition of the network so that the monitoring can be adapted to focus on traffic which relates to a particular suspected or detected threat.
Claims22
A method of monitoring data traffic in a communication network, comprising:
- receiving the data traffic at a router connected to said communication network;
- monitoring, at said router, a flow of said received data traffic at a predetermined point on a flow path carrying said flow of the received data traffic, wherein said monitoring comprises a single stage monitoring process performed using exclusively one of a plurality of different monitoring criteria, including a first monitoring criteria and a second monitoring criteria, such that the data traffic that is subject to monitoring at said predetermined point is only monitored according to one of said monitoring criteria, and the second monitoring criteria isolates characteristics of a malicious threat;
- said monitoring further including monitoring said flow of the received data traffic at said predetermined point on said flow path according to said first monitoring criteria;
- based on information contained in the data traffic monitored according to the first monitoring criteria, determining whether data in the traffic is indicative of the malicious threat to one or more resources connected to said communication network, and only if said determining step determines that data in said traffic is indicative of the malicious threat, changing the monitoring criteria in said single stage monitoring process from the first monitoring criteria to the second monitoring criteria;
- and
- monitoring subsequently received data traffic at said predetermined point along said flow path according to said second monitoring criteria, instead of said first monitoring criteria.
3 more elements
A network element for receiving and routing data traffic in a communication network, comprising:
- an interface configured to receive the data traffic from the communication network;
- a single stage monitor configured to monitor a flow of said received data traffic at a predetermined point on a flow path carrying said flow of the received data traffic, wherein said single stage monitor is configured only to perform a single stage monitoring process using an exclusive one of a plurality of different monitoring criteria, including a first monitoring criteria and a second monitoring criteria, such that the data traffic that is subject to monitoring at said predetermined point is only monitored according to one of said plurality of different monitoring criteria, and the second monitoring criteria isolates characteristics of a malicious threat;
- and
- a module configured to determine, based on information contained in the data traffic monitored by said single stage monitor according to said first monitoring criteria, whether the monitored data in the traffic is indicative of the malicious threat to one or more resources connected to said communication network, and only if said module determines that data in said traffic is indicative of the malicious threat, said module causing said monitoring criteria in said single stage monitor to change from said first monitoring criteria to said second monitoring criteria, said single stage monitor thereby being conditioned to monitor subsequently received data traffic at said predetermined point along said flow path according only to said second monitoring criteria instead of said first monitoring criteria.
1 more element
A network element for receiving and routing data traffic in a communication network, comprising:
- an interface configured to receive the data traffic from the communication network;
- a single stage monitor configured to monitor a flow of said received data traffic at a predetermined point on a flow path carrying said flow of the received data traffic, wherein said single stage monitor is configured only to perform a single stage monitoring process using an exclusive one of a plurality of different monitoring criteria, including a first monitoring criteria and a second monitoring criteria, such that the data traffic that is subject to monitoring at said predetermined point is only monitored according to one of said plurality of different monitoring criteria, and the second monitoring criteria isolates characteristics of a malicious threat;
- and
- wherein said single stage monitor is responsive to a detector only detecting that data in the traffic indicative of the malicious threat to one or more resources connected to said communication network to change said monitoring criteria from said first monitoring criteria to said second monitoring criteria, said single stage monitor thereby being conditioned to monitor subsequently received traffic at said predetermined point along said flow path according only to said second monitoring criteria instead of said first monitoring criteria.
1 more element
Dependencies are inferred from the claim text.