Correlating discarded network traffic with network policy events through augmented flow

Patent metadata

Field	Value
Publication number	US-11546266-B2
Application number	US-201615380735-A
Country	US
Kind code	B2
Filing date	Dec 15, 2016
Priority date	Dec 15, 2016
Publication date	Jan 3, 2023
Grant date	Jan 3, 2023

Abstract

A method for correlating discarded network traffic with network policy events in a network includes receiving a flow record. The flow record includes initial network flow information in a standard flow record format. Discarded network traffic information associated with each network policy is received from a network policy enforcement device. Network traffic is discarded based on a network traffic policy. The received flow record is correlated with the received discarded network traffic information. The discarded network traffic information is encoded into the received flow record based on the correlation while maintaining the initial network flow information to yield an enhanced flow record.

First claim

What is claimed is:

1. A method for correlating discarded network traffic with network policy events in a network, the method comprising:
receiving a flow record from a first network device in a second network device, the flow record including initial network flow information in a flow record format;
receiving, by the second network device, network traffic information discarded by an attack mitigation enforcement device;
correlating, by the second network device, the received flow record with the received discarded network traffic information related to changes in one or more traffic policies relative to information in the received flow record wherein prescribed user configuration determines the discarded network traffic information to be correlated with the received flow record;
encoding, by the second network device, the discarded network traffic information in the received flow record based on the correlation while maintaining the initial network flow information to yield an enhanced flow record whereby one or more field definitions are added to the received flow record to be populated with the received discarded network traffic information; and
providing a report to a user relating to the enhanced flow information including augmented network flow information indicating specific flow records as configured by a user.

2. The method as recited in claim 1 , further comprising storing the enhanced flow record in a flow record repository.

3. The method as recited in claim 1 , further comprising receiving network traffic policy information from the first network device.

4. The method as recited in claim 3 , wherein the network traffic policy information comprises a plurality of discard rules configured to discard network traffic matching predetermined criteria.

5. The method as recited in claim 3 , further comprising monitoring one or more network flows using a plurality of the enhanced flow records stored in the flow record repository.

6. The method as recited in claim 1 , wherein the discarded network traffic information includes at least a number of dropped packets.

7. The method as recited in claim 1 , wherein the network comprises a software defined network (SDN) and wherein the first network device and the second network device comprise SDN enabled network devices.

8. The method as recited in claim 7 , wherein the first network device and the second network device are communicatively coupled to an SDN controller and wherein receiving the discarded network traffic information comprises receiving, by the second network device, the discarded network traffic information.

9. The method as recited in claim 8 , wherein the SDN network devices comprise OpenFlow switches and wherein the SDN controller comprises an OpenFlow controller.

10. A monitoring system comprising:
a monitored network comprising a plurality of devices;
one or more physical network elements;
an attack mitigation enforcement device communicatively coupled to the monitored network by the one or more physical network elements;
a flow record repository for storing flow record information; and
one or more network monitoring devices communicatively coupled to the network policy enforcement device and to the monitored network by the one or more physical network elements and communicatively coupled to the flow record repository, wherein the one or more network monitoring devices are configured and operable to:
receive a flow record including initial network flow information from the one or more physical network elements in a flow record format;
receive discarded network traffic information associated with network traffic dropping policy from the attack mitigation enforcement device;
correlate the received flow record with the received discarded network traffic information related to changes in one or more traffic policies relative to information in the received-flow record wherein prescribed user configuration determines the discarded network traffic information to be correlated with the received flow record; and

encode the discarded network traffic information in the received flow record based on the correlation while maintaining the initial network flow information to yield an enhanced flow record whereby one or more field definitions are added to the received flow record to be populated with the received discarded network traffic information; and
provide a report to a user relating to the enhanced flow information including augmented network flow information indicating specific flow records as configured by a user.

11. The monitoring system as recited in claim 10 , wherein the one or more network monitoring devices are further configured and operable to store the enhanced flow record in the flow record repository.

12. The monitoring system as recited in claim 10 , wherein the one or more network monitoring devices are further configured and operable to receive network traffic dropping policy information from the one or more physical network elements.

13. The monitoring system as recited in claim 12 , wherein the network traffic dropping policy comprises a plurality of discard rules configured to discard network traffic matching predetermined criteria.

14. The monitoring system as recited in claim 10 , wherein the discarded network traffic information includes at least a number of dropped packets.

15. A software-defined network (SDN) traffic monitoring system comprising:
a monitored SDN network comprising a plurality of devices;
a SDN enabled switch communicatively coupled to the monitored network;
a SDN controller configured to interface with the SDN enabled switch;
an attack mitigation enforcement device communicatively coupled to the monitored SDN network;
a flow record repository for storing flow record information; and
one or more network monitoring devices communicatively coupled to the SDN enabled switch by the SDN controller and communicatively coupled to the flow record repository, wherein the one or more network monitoring devices are configured and operable to:
receive a flow record including initial network flow information from the SDN controller in a flow record format;
receive discarded network traffic information associated with network traffic dropping policy from the attack mitigation enforcement device;
control the data flow rate to prevent a TCP end system from sending data packets at rates greater than an access link permits to control queuing in router buffers;
correlate the received flow record with the received discarded network traffic information related to changes in one or more traffic policies relative to information in the received traffic flow wherein prescribed user configuration determines the discarded network traffic information to be correlated with the received flow record;

encode the discarded network traffic information in the received flow record based on the correlation while maintaining the initial network flow information to yield an enhanced flow record whereby one or more field definitions are added to the received flow record to be populated with the received discarded network traffic information, whereby a user selects the discarded network traffic information to be encoded in the received flow record, wherein discarded selected network traffic information is selected from the group consisting of: an Access Control List (ACL); a flow specification object; and a black hole route; and
provide a report to a user relating to the enhanced flow information including augmented network flow information indicating specific flow records as configured by a user.

16. The monit

Assignees

• Arbor Networks
• Arbor Networks Inc

Inventors

• Mortensen Andrew D
• Winquist James E

Classifications

• H04L47/2441 Primary

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title

• H04L47/32

  by discarding or delaying data units, e.g. packets or frames · CPC title

• H04L43/0829

  Packet loss · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L63/1458

  Denial of Service · CPC title