Apparatus and method for network analysis

Abstract

A system for, and method of, extracting information from multiple sessions and in accordance with disparate protocols, and transforming the same into a common language. Packets are collected by packet collectors distributed throughout a network and those packets, and/or metadata relating to those packets, are passed to an aggregator, which is made available via an application program interface to users/applications.

1 . A method of analyzing network traffic, comprising:
 obtaining packets traversing an electronic data network;   sending the packets to an assembler and assembling the packets into at least one session, wherein the at least one session comprises a network transaction between a first entity and a second entity;   translating the at least one session into metadata that conforms to an event-based language; and   creating a record, based on the metadata, containing a session statement that includes a property statement regarding the session, and an event statement that includes a property statement regarding the event.   
     
     
         2 . The method of  claim 1 , wherein the step of obtaining comprises copying packets from the electronic data network. 
     
     
         3 . The method of  claim 1 , further comprising parsing the packets based on protocol. 
     
     
         4 . The method of  claim 1 , wherein the first and second entity comprise a computer, a user, or a resource. 
     
     
         5 . The method of  claim 1 , wherein the property statement regarding the session comprises at least one of time, size, or service type. 
     
     
         6 . The method of  claim 1 , wherein the property statement regarding the event identifies an action, and the action comprises at least one of the following action types: User Login, User Logoff, Get Resource, Put Resource, Delete Resource, Send Message, Receive Message, Read Message, Delete Message, Database Query, User Login Response, User Logoff Response, Get Resource Response, Delete Resource Response, Send Message Response, Read Message Response, or Database Query Response. 
     
     
         7 . The method of  claim 6 , further comprising presenting the metadata in accordance with the following structure:
 “<the first entity> was seen <the action> to <the second entity> with <the application>.”   
     
     
         8 . The method of  claim 1 , wherein property statement regarding the event identifies an application and the application is one of the following application types: FTP, Telnet, SMTP, Domain Name Service, DHCP, AOL™ Instant Messenger, Yahoo™ Instant Messenger, HTTP, POP-2, POP-3, NNTP, Microsoft RPC, Netbios, MS File Access, SNMP, RIP, MS Instant Messenger, Lotus Notes™, Sybase™ Database, MSSQL™ Database, Oracle™ Database, Lotus Sametime™, Unix™ File Access, or IRC. 
     
     
         9 . The method of  claim 1 , wherein the event statement identifies one of the following content types: Mail, HTML, DCARD, SMIME, or PGP. 
     
     
         10 . The method of  claim 1 , further comprising generating a route statement describing a route through the network traveled by the session, wherein the record also contains the route statement. 
     
     
         11 . The method of  claim 1 , further comprising generating an alias statement describing information related to an identity of the first entity or the second entity, wherein the record also contains the alias statement. 
     
     
         12 . The method of  claim 11 , wherein the alias statement contains at least one of the following alias types: IP-Alias or User-Alias. 
     
     
         13 . The method of  claim 1 , wherein the metadata comprises a global property name. 
     
     
         14 . A method of analyzing network traffic, comprising:
 obtaining packets traversing an electronic data network;   sending the packets to an assembler and assembling the packets into at least one session, wherein the at least one session comprises a network transaction between a first entity and a second entity;   translating the at least one session into metadata that conforms to an event-based language; and   based on the metadata, generating a session statement that includes a property statement regarding the session, and an event statement that includes a property statement regarding the event.   
     
     
         15 . The method of  claim 14 , wherein the property statement regarding the session comprises at least one of time, size, or service type. 
     
     
         16 . The method of  claim 14 , wherein the property statement regarding the event identifies an action and the action comprises at least one of the following action types: User Login, User Logoff, Get Resource, Put Resource, Delete Resource, Send Message, Receive Message, Read Message, Delete Message, Database Query, User Login Response, User Logoff Response, Get Resource Response, Delete Resource Response, Send Message Response, Read Message Response, or Database Query Response. 
     
     
         17 . The method of  claim 16 , further comprising presenting the metadata in accordance with the following structure:
 “<the first entity> was seen <the action> to <the second entity> with <the application>.”   
     
     
         18 . The method of  claim 14 , wherein property statement regarding the event identifies an application and the application is one of the following application types: FTP, Telnet, SMTP, Domain Name Service, DHCP, AOL™ Instant Messenger, Yahoo™ Instant Messenger, HTTP, POP-2, POP-3, NNTP, Microsoft RPC, Netbios, MS File Access, SNMP, RIP, MS Instant Messenger, Lotus Notes™, Sybase™ Database, MSSQL™ Database, Oracle™ Database, Lotus Sametime™, Unix™ File Access, or IRC. 
     
     
         19 . The method of  claim 14 , wherein the metadata comprises a global property name. 
     
     
         20 . A method of analyzing network traffic, comprising:
 receiving electronic data representative of an electronic data network session that has taken place between a first entity and a second;   translating the session into metadata that conforms to an event-based language; and   creating a record, based on the metadata, containing a session statement that includes a property statement regarding the session, and an event statement that includes a property statement regarding the event.