Back to results
US 9,961,106 B2Granted
Filtering legitimate traffic elements from a DoS alert
AssigneeArbor Networks, Inc.
InventorsDavid Watson, Anthony Danducci, Joanna Markel, Willie Northway, Steven Lyskawa, James E. Winquist
Life of this patent
Estimating the term…
Abstract
A method for monitoring traffic flow in a network is provided. A network monitoring probe monitors one or more network traffic flow parameters to detect a denial of service attack. In response to detecting the denial of service attack, a first set of data representing the denial of service attack alert is displayed. Filtering criteria are received from a user. The filtering criteria include at least one of the network flow parameters identified as legitimate network traffic. A second set of data is generated and displayed based on the filtering criteria.
Claims18
A computer-implemented method for monitoring traffic in a network, the method comprising:
- monitoring, by a network monitoring probe, one or more network traffic flow parameters to detect a denial of service attack;
- displaying a first set of data in a graphical user interface (GUI), in response to detecting the denial of service attack, the first set of data representing a denial of service attack alert, wherein the denial of service attack alert comprises at least a first section representing alert summary information, a second section representing top traffic patterns associated with the denial of service attack alert, and a third section representing top contributing network elements associated with the denial of service attack alert, wherein the first section comprises at least alert duration, alert severity level and an IP address of the device targeted by the attack, and wherein the GUI includes one or more user interface control components;
- dynamically receiving from a user, using the one or more user interface control components, filtering criteria comprising at least one of the one or more network traffic flow parameters identified as legitimate network traffic;
- and
- generating and displaying in the GUI a second set of data representing the denial of service attack alert based on the filtering criteria.
2 more elements
A computer program product for monitoring control traffic in a network, the computer program product comprising:
- one or more computer-readable storage devices and a plurality of program instructions stored on at least one of the one or more computer-readable storage devices, the plurality of program instructions comprising:
- program instructions to monitor one or more network traffic flow parameters to detect a denial of service attack;
- program instructions to display a first set of data in a graphical user interface (GUI), the first set of data representing a denial of service attack alert, wherein the denial of service attack alert comprises at least a first section representing alert summary information, a second section representing top traffic patterns associated with the denial of service attack alert, and a third section representing top contributing network elements associated with the denial of service attack alert, wherein the first section comprises at least alert duration, alert severity level and an IP address of the device targeted by the attack, and wherein the GUI includes one or more user interface control components;
- program instructions to dynamically receive from a user, using the one or more user interface control components, filtering criteria comprising at least one of the one or more network traffic flow parameters identified as legitimate network traffic;
- and
- program instructions to generate and display in the GUI a second set of data representing the denial of service attack alert based on the filtering criteria.
3 more elements
A computer-implemented method for monitoring traffic in a network, the method comprising:
- monitoring, by a network monitoring probe, one or more network traffic flow parameters to detect a denial of service attack;
- displaying a first set of data in a graphical user interface (GUI), in response to detecting the denial of service attack, the first set of data representing a denial of service attack alert, wherein the denial of service attack alert comprises at least a first section representing alert summary information, a second section representing top traffic patterns associated with the denial of service attack alert, and a third section representing top contributing network elements associated with the denial of service attack alert, wherein the first section comprises at least alert duration, alert severity level and an IP address of the device targeted by the attack, and wherein the GUI includes one or more user interface control components;
- dynamically receiving from a user, using the one or more user interface control components, filtering criteria comprising at least one of the one or more network traffic flow parameters identified as legitimate network traffic;
- and
- generating and displaying in the GUI a second set of data representing the denial of service attack alert wherein the one or more network traffic flow parameters identified as legitimate network traffic is removed from the monitored one or more network traffic flow parameters displayed in the second set of data via the GUI.
2 more elements
Dependencies are inferred from the claim text.