At&t Intellectual Property I, L.p.

At+t Corp.

Jeanette LaRosa

Chaim Spielman

David Gross

Philip E Brown

Willa Kay Ehrlich

Daniel F Hurley

Carl Brian Rexroad

Myra E Agostino

Method and apparatus for port sweep detection in a network is described. In one example, log data is obtained for a period of time. The log data is associated with a plurality of devices in the network. The log data is processed to identify connection requests from a source key for a port at a number of target internet protocol (IP) addresses. An alarm is generated if the number of target IP addresses associated with the connection requests from the source key exceeds a threshold.

Method and apparatus for port scan detection in a network

A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate. In turn, the present method raises an alarm if the traffic aggregate's traffic share ratio to be evaluated exceeds or falls below the traffic share ratio threshold defined for the traffic aggregate.

Method and apparatus for volumetric thresholding and alarming on internet protocol traffic

Method and apparatus for analyzing source internet protocol (SIP) activity in a network is described. In one example, a SIP address is obtained. Log data collected over a predefined time period by a plurality of network facilities is automatically queried using the SIP address as parametric input to generate a report. The report includes sample activity for the SIP and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.

Method and apparatus for analyzing source internet protocol activity in a network

Growing community of inventors

Kingston, NJ, United States of America

Jeanette LaRosa