Synthetic data for determining health of a network security system

Patent metadata

Field	Value
Publication number	US-11902120-B2
Application number	US-202016893854-A
Country	US
Kind code	B2
Filing date	Jun 5, 2020
Priority date	Jun 5, 2015
Publication date	Feb 13, 2024
Grant date	Feb 13, 2024

Abstract

An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
capturing data traversing a network from at least one source node to at least one destination node;
determining that the captured data corresponds to a pattern, wherein the pattern is associated with expected behavior of one or more nodes of a plurality of nodes;
selecting at least one node of the plurality of nodes for generating second data corresponding to the pattern, wherein the selected node is not the at least one source node or the at least one destination node;
causing the at least one selected node of the plurality of nodes to generate the second data corresponding to the pattern, wherein the second data is associated with actual behavior of the at least one selected node;
comparing the actual behavior with the expected behavior; and
when the actual behavior does not correspond to the expected behavior, generating an alert that the at least one selected node of the plurality of nodes is non-conforming.

2. The computer-implemented method of claim 1 , wherein the captured data includes network traffic data and associated data, using at least a first sensor of a first virtual machine of the network, a second sensor of a first server hosting the first virtual machine, and a third sensor of a first networking device connected to the first server, the method further comprising:
determining a plurality of patterns in the network traffic data and the associated data; and
causing respective data corresponding to each of the plurality of patterns to be generated over a specified period of time.

3. The computer-implemented method of claim 2 , further comprising:
selecting a random order for the respective data corresponding to each of the plurality of patterns to be generated from a configured set of patterns.

4. The computer-implemented method of claim 1 , wherein the at least one selected node is selected by: selecting a port of the at least one selected node of the plurality of nodes from which to generate a respective portion of the data corresponding to the pattern.

5. The computer-implemented method of claim 1 , wherein the pattern corresponds to at least one of a DDoS attack, a MAC address spoofing, a port knock, or normal traffic.

6. The computer-implemented method of claim 1 , wherein a packet of the pattern includes a flag indicating the packet is a synthetic packet.

7. The computer-implemented method of claim 1 , further comprising:
when the actual behavior corresponds to the expected behavior, generating an alert that the at least one selected node of the plurality of nodes is conforming, wherein the alert includes providing information to a presentation module.

8. A non-transitory computer-readable medium comprising instructions stored thereon that, when executed, cause a computing device to:
capture data traversing a network from at least one source node to at least one destination node;
determine, from the captured data generated by a plurality of nodes of the network, that the captured data corresponds to a pattern, wherein the pattern is associated with expected behavior of one or more nodes of the plurality of nodes;
select at least one node of the plurality of nodes for generating second data corresponding to the pattern, wherein the selected node is not the at least one source node;
cause the at least one selected node of the plurality of nodes to generate the second data corresponding to the pattern, wherein the second data is associated with actual behavior of the at least one selected node;
compare the actual behavior with the expected behavior; and
when the actual behavior does not correspond to the expected behavior, generate an alert that the at least one selected node of the plurality of nodes is non-conforming.

9. The non-transitory computer-readable medium of claim 8 , wherein the captured data includes network traffic data and associated data using at least a first sensor of a first virtual machine of the network, a second sensor of a first server hosting the first virtual machine, and a third sensor of a first networking device connected to the first server, the medium comprising further instructions, which when executed, further cause the computing device to:
determine a plurality of patterns in the network traffic data and the associated data; and
cause respective data corresponding to each of the plurality of patterns to be generated over a specified period of time.

10. The non-transitory computer-readable medium of claim 9 , comprising further instructions, which when executed, further cause the computing device to:
select a random order for the respective data corresponding to each of the plurality of patterns to be generated from a configured set of patterns.

11. The non-transitory computer-readable medium of claim 8 , wherein the at least one selected node is selected by: selecting a port of the at least one selected node of the plurality of nodes from which to generate a respective portion of the data corresponding to the pattern.

12. The non-transitory computer-readable medium of claim 8 , wherein the pattern corresponds to at least one of a DDoS attack, a MAC address spoofing, or a port knock.

13. The non-transitory computer-readable medium of claim 8 , wherein a packet of the pattern includes a flag indicating that the packet is a synthetic packet.

14. The non-transitory computer-readable medium of claim 8 , comprising further instructions, which when executed, further cause the computing device to:
when the actual behavior corresponds to the expected behavior, generate an alert that the at least one selected node of the plurality of nodes is conforming, wherein the alert includes providing information to a presentation module.

15. A system comprising:
a processor; and
a memory including instructions that, when executed by the processor, cause the processor to:
capture data traversing a network from at least one source node to at least one destination node;
determine, from the captured data generated by a plurality of nodes of the network, that the captured data corresponds to a pattern, the pattern associated with expected behavior of one or more nodes of the plurality of nodes;
select at least one node of the plurality of nodes for generating second data corresponding to the pattern, wherein the selected node is not the at least one source node;
cause the at least one selected node of the plurality of nodes to generate the second data corresponding to the pattern, wherein the second data is associated with actual behavior of the at least one selected node;
compare the actual behavior with the expected behavior; and
when the actual behavior does not correspond to the expected behavior, generate an alert that the at least one selected node of the plurality of nodes is non-conforming.

16. The system of claim 15 , wherein the captured data includes
network traffic data and associated data using at least a first sensor of a first virtual machine of the network, a second sensor of a first server hosting the first virtual machine, and a third sensor of a first networking device connected to the first server, and the system comprising further instructions, which when executed by the processor cause the processor to:
determine a plurality of patterns in the network traffic data and the associated data; and
cause respective data corresponding to each of the plurality of patterns to be generated over a specified period of time.

17. The system of claim 16 , comprising further instructions, which when executed by the processor cause the

Assignees

• Cisco Tech Inc

Inventors

• Prasad Rohit Chandra
• Viswanathan Bharathwaj Sankara
• Nguyen Hoang Viet
• Jeyakumar Vimalkumar
• Spadaro Roberto Fernando
• Malhotra Varun Sagar
• Yadav Navindra

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L67/01

  Protocols · CPC title