Enforcing network service level agreements in a network infrastructure element comprises receiving, at the network infrastructure element, an application-layer message comprising one or more of the packets; forwarding the application-layer message toward a destination endpoint and concurrently copying the application-layer message without disrupting the forwarding; using the copied application-layer message, discovering one or more applications or services that are using the network; using the copied application-layer message, identifying one or more network-layer condition metrics, and identifying one or more application-layer condition metrics; determining, based on the identified network-layer condition metrics and the application-layer condition metrics, whether one or more conditions of a service level agreement are violated; and in response to determining a violation, performing one or more responsive operations on one or more network elements.

Enforcing network service level agreements in a network element

An instruction detection system (1) (IDS) is capable of identifying the source of traffic, filtering the traffic (28) to classify it as either safe or suspect and then applying sophisticated detection techniques such as stateful pattern recognition, protocol parsing, heuristic detection or anomaly detection either singularly or in combination based on the traffic type. In a network environment, each traffic source (12) is provided with at least one IDS sensor (22-24) that is dedicated to monitoring a specific type of traffic such as RPC, HTTP, SMTP, DNS, or others. Traffic from each traffic source (12) is filtered to remove known safe traffic to improve efficiency and increase accuracy by keeping each IDS sensor (22-24) focused on a specific traffic type.

Intrusion detection in a data center environment

A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.

Method and apparatus for generating a network topology representation based on inspection of application messages at a network device

An electronic message is analyzed for malware contained in the message. Text of an electronic message may be analyzed to detect and process malware content in the electronic message itself. The present technology may analyze an electronic message and attachments to electronic messages to detect a uniform resource location (URL), identify whether the URL is suspicious, and analyze all suspicious URLs to determine if they are malware. The analysis may include re-playing the suspicious URL in a virtual environment which simulates the intended computing device to receive the electronic message. If the re-played URL is determined to be malicious, the malicious URL is added to a black list which is updated throughout the computer system.

Electronic message analysis for malware detection

A dynamic signature creation and enforcement system can comprise a tap configured to copy network data from a communication network, and a controller coupled to the tap. The controller is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data is suspicious, flag the network data as suspicious based on the heuristic determination, simulate transmission of the network data to a destination device to identify unauthorized activity, generate an unauthorized activity signature based on the identification, and transmit the unauthorized activity signature to a digital device configured to enforce the unauthorized activity signature.

Dynamic signature creation and enforcement

A system and method is presented for analyzing information in a communication line for unwanted intrusions and for allowing information to be transmitted back into the communication line without disrupting the communication traffic when an intrusion is detected. The system and method includes a security tap connected to a firewall. The security tap is also connected to an intrusion detection device. The intrusion detection device analyzes the information in the communication line for indicia of attempts to compromise the network. When such indicia is detected, the intrusion detection device sends a “kill” data packet back through the security tap and directed back to the communication line to the firewall to instruct the firewall to prevent further communications into the network by the intrusive source. An Ethernet switch or field programmable gate array (FPGA) is incorporated in the security tap to coordinate the transmission of the “kill” data packet to avoid data collisions with data transmissions already existing in the communication line.

Network security tap for use with intrusion detection system

A system and method is presented for a network tap having integrated circuitry therein for obtaining statistics about a communication line. The network tap also has a routing node for allowing information to be transmitted back into the communication line from an attached device without disrupting the communication traffic. The routing node coordinates the transmission of device data from an attached device to avoid data collisions with data transmissions already existing in the communication line. The routing node may be an Ethernet switch or field programmable gate array (FPGA). The integrated circuit may be a microprocessor or FPGA. The integrated circuit also controls other components of the network tap. The integrated circuit may also be programmed or upgraded to provide other functions.

Network tap with integrated circuitry

A network tap for enabling attached devices, such as an intrusion detection system, to transmit information into a communication line of the network without disrupting the network traffic on the communication line. When the attached device is an intrusion detection device, the network tap is connected to a firewall. An Ethernet switch or field programmable gate array (FPGA) is incorporated in the network tap to coordinate the transmission of device data to avoid data collisions with data transmissions already existing in the communication line. The network tap may be operated in various modes to accommodate different capabilities of attached devices. In addition, the network tap has various port configurations to allow a user to connect various attached devices through a single cable or dual cables and to connect various combinations of attached devices.

Network tap for use with multiple attached devices

A network monitoring architecture and methodology enabling performance detection and diagnostics in storage area networks or other networks. The network monitoring is performed using a three-tiered distributed computing system architecture, including a data source tier, a portal tier and a client tier. The data source tier monitors the physical data on the network medium using multiple data collection sources, or data probes, connected to the network. The probes analyze network data and generate metrics that describe attributes of the network data. The metrics are synchronized in time by virtue of time stamps associated with the data monitored by the data probes. The time-synchronized metrics are used by the data portal tier, which is the second tier of the system. The portal tier encapsulates the metrics into data containers. The data containers may be requested by the client tier, which is the third tier in the network monitoring system. The client tier provides a user interface for displaying various types of network information derived from the contents of data containers.

System and method for network traffic and I/O transaction monitoring of a high speed communications network

A network tap for enabling attached devices, such as an intrusion detection system, to transmit information into a communication line of the network without disrupting the network traffic on the communication line. When the attached device is an intrusion detection device, the network tap is connected to a firewall. An Ethernet switch or field programmable gate array (FPGA) is incorporated in the network tap to coordinate the transmission of device data to avoid data collisions with data transmissions already existing in the communication line. The network tap may be operated in various modes to accommodate different capabilities of attached devices. In addition, the network tap has various port configurations to allow a user to connect various attached devices through a single cable or dual cables.

Robert W. Otis

Papers

Network security tap for use with intrusion detection system

Network tap with integrated circuitry

Network tap for use with multiple attached devices

System and method for network traffic and I/O transaction monitoring of a high speed communications network

Network tap with interchangeable ports