Qosmos

Gautier Harmel

Jerome Tollet

Jérôme Tollet

Eric Horlait

Serge Fdida

Guy Pujolle

Jérome Tollet

A distributed system for analyzing traffic flow on a communications network architecture where a computer provides information over a data network to a concentrator, which provides a bridge between the computer and the end user terminals. The interface between the terminals and the concentrator is provided through access points for each workstation. The system to analyze the traffic is distributed into three components that perform, respectively, classification of the traffic flow, processing of the results of the classification, and handling of the processed results.

Distributed traffic analysis

The present invention provides a traffic analyzing system on a communications link having analyzer circuits connected to each other by a number of links, where each analyzer circuit has a data rate lower than the data rate of the communications link, and are adapted to perform respective different levels of analysis on packets. The information extracted from the packets analyzed at a first level of analysis by a first analyzer circuit is forwarded to a second level of analysis performed at a second analyzer circuit, where the additional analysis performed by the second analyzer circuit depends on the analysis performed by the first analyzer circuit. Such a system and associated method allows for an efficient, practical, and improved traffic flow analyses for computer networks to evaluate high-speed and heavy traffic flow, as well as for improved protocol analysis for emerging technologies.

Traffic analysis on high-speed networks

The invention concerns a digital processing system fed by at least one filter having three possible states resulting from one or more conditions on one or more protocol attributes, specified for a semantic stream. Each protocol attribute is specified by an ordered sequence of protocol names used in the semantic stream and a parameter name carried by a protocol whereof the name is indicated in the ordered sequence of protocol names. The digital processing device comprises a filtering engine which applies the filter on the communication data until the data provide protocol attribute values wherefrom results a valid or invalid state of the filter and an action motor which triggers the action when the state of the filter is valid.

Method and computer system for triggering an action on digital communication data

A method for protocol identification by recognizing determinative data among data transmitted through a detected connection using lists of explicit and implicit son protocols associated with each protocol. The kernel of an information system associates to each detected connection a data structure arranged so that it comprises an ordered sequence of the protocol names. The kernel builds the data structure by retrieving the son protocol names in the list associated to the last protocol name of said ordered sequence, the son protocol name for which the associated self identification mechanism recognizes determinant data among transmitted data by adding the retrieved son protocol name to the end of the sequence and by restarting to retrieve the son protocol name for which the associated self identification mechanism recognizes determinant data among transmitted data.

Growing community of inventors

Paris, France

Gautier Harmel