Intelligent feedback loop process control system

Abstract

There is disclosed a system and method for detecting attacks on a site in a communication network and for taking action to reduce or redirect such attacks. A monitor system reviews incoming data packets and sends directions to at least one router to change the data flow in the system. The directions may be sent to other routers. The data packets and the resulting work flow are modified for certain conditions, and for certain conditions within defined time slices, and action is taken when the monitored condition is contrary to expected conditions.

What is claimed is:  
     
         1 . A communication system, in which packet messages can be directed from anyone of a plurality of sending devices to one or more receiving devices, the receiving devices adapted for receiving such packet messages and for responding thereto, the system comprising: 
 a network over which each packet can travel, said network being temporally available for each packet and defined according to address information contained within each such packet, said packet routed along said temporal network by routers operating under partial control of packet address information;    at least one receiving device arranged in association with at least one gateway router, said gateway router serving to direct only those packets containing the address information of said associated receiving device to said associated receiving device;    a monitoring system operating in conjunction with said receiving device for gathering information pertaining to the operation of said receiving device; and    a feedback network for modifying the operational characteristics of said gateway router depending upon said gathered information.    
     
     
         2 . The invention set forth in  claim 1  wherein said gathered information is selected from the list containing: 
 number of arriving packets in a particular time interval;  
 the type of requests contained within given packets;  
 the nature of the informational content of the packets;  
 the sending identity of the packets;  
 the response destination of the packets;  
 the traffic patterns formed by packets from specific sources;  
 the number of arriving packets from specific sources;  
 certain data contained in one or more messages; and  
 the type of file attached to a message.  
 
     
     
         3 . The invention of  claim 1  wherein said feedback network operates to compare said gathered information with certain pre-established criteria and to set limits, and wherein said operational characteristics of said gateway router are modified in accordance with said set limits.  
     
     
         4 . The invention of  claim 3  wherein said limits are dynamically changeable.  
     
     
         5 . The invention set forth in  claim 3  wherein said limits are changed manually.  
     
     
         6 . The invention set forth in  claim 1  wherein said gathered information is compared to statistics generated from said receiving device over a period of time.  
     
     
         7 . The invention set forth in  claim 6  wherein said statistics are gathered to reflect normal receiving device behavior over a period of time.  
     
     
         8 . The invention set forth in  claim 1  wherein said gathered information is dynamically changeable.  
     
     
         9 . The invention set forth in  claim 1  wherein said behavior change of said gateway router is selected from one or more of the following list: 
 blocking certain packets from reaching said receiving device;  
 blocking all packets from reaching said receiving device;  
 rerouting certain packets to another receiving device;  
 modifying the informational content of certain ones of said packets;  
 unblocking certain hitherto blocked packets, on the basis of certain parameters; and  
 modifying the informational content of certain ones of said packets.  
 
     
     
         10 . The invention set forth in  claim 1  wherein said feedback network stores information pertaining to received ones of said packets.  
     
     
         11 . The invention set forth in  claim 1  further including: a system for monitoring packets leaving said receiving device; and 
 wherein said feedback network is further operable to selectively modify the operational characteristics of said gateway router with respect to said leaving packets.  
 
     
     
         12 . The invention set forth in  claim 1  wherein said monitoring system further gathers information pertaining to certain of said data packets; said last-mentioned gathered data useful for providing information about the history of said certain packets.  
     
     
         13 . The invention set forth in  claim 12  wherein said last-mentioned gathered data is stored for future use.  
     
     
         14 . The invention set forth in  claim 12  wherein said certain data is selected according to a set of parameters pertaining to operation of said receiving device.  
     
     
         15 . The invention set forth in  claim 1  wherein said feedback network is further operable for modifying operational characteristics of said communication system remote from said router.  
     
     
         16 . The invention set forth in  claim 1  wherein said monitoring system and said feedback network are operational at least in part at an enterprise system served by said gateway router.  
     
     
         17 . A monitor system for use in conjunction with a particular site on a communication network; said site arranged to receive data addressed thereon via a network control device associated with said site and to send out onto the communication network via said control device data addressed to other communication network sites; said monitor system comprising: 
 at least one system for tracking data flow situations within said particular site, said data flow situations selected from one or more of the following list: amount of arriving data in a particular time interval; the type of requests contained within given data; the nature of the informational content of the data; the sending identity of the data; the response destination of the data; the traffic patterns formed by data from specific sources; the amount of arriving data from specific sources; and identification of a specific data pattern; and    wherein said tracking system sends instructions from time to time to said control device to affect the flow of data to said particular site.    
     
     
         18 . The invention set forth in  claim 17  wherein said instructions from said tracking system are in part dependent upon a comparison of said tracked data flow situations with a pre-established set of parameters.  
     
     
         19 . The invention set forth in  claim 18  wherein said parameters are dynamically changing.  
     
     
         20 . The invention set forth in  claim 18  wherein said parameters are based on statistical data gathered over a period of time with respect to the operation of said particular site.  
     
     
         21 . The invention set forth in  claim 18  wherein said parameters are established from time to time manually.  
     
     
         22 . The invention set forth in  claim 18  wherein said parameters are received from a database.  
     
     
         23 . The invention set forth in  claim 17  wherein said data flow tracking system includes means for gathering information pertaining to certain of said data arriving at said particular site; said data to be gathered being useful for providing information about the history of said data.  
     
     
         24 . The invention set forth in  claim 23  wherein said last-mentioned gathered data is stored for future use.  
     
     
         25 . The invention set forth in  claim 23  wherein said last-mentioned gathered data is selected according to a set of parameters pertaining to operation of said particular site.  
     
     
         26 . The invention set forth in  claim 17  wherein said data flow is effected by controlling data through a gateway unique to said particular site.  
     
     
         27 . The invention set forth in  claim 17  wherein said data flow is effected by controlling data through one or more nodes remote from said particular sites.  
     
     
         28 . A flow control system for use in conjunction with at least one node on a communication network, said network operational for passing data between nodes of said network, said system comprising: 
 means for real time review of certain parameters pertaining to data flowing between nodes of said network;    means for comparing said monitored parameters against stored criteria; and    means for feeding data traffic affecting signals to one or more of said nodes under at least partial control of said comparing means.    
     
     
         29 . The invention set forth in  claim 28  wherein said stored criteria are dynamically changeable.  
     
     
         30 . The invention set forth in  claim 29  further including: 
 means for storing certain of said monitored parameters for a period of time, at least some of said stored parameters being useful in determining at least a portion of the communication history of said monitored data.  
 
     
     
         31 . The invention set forth in  claim 28  wherein at least one of said nodes is said at least one node.  
     
     
         32 . The invention set forth in  claim 31  wherein said at least one node is a gateway node to a particular data source.  
     
     
         33 . The method of controlling data flow in a communication system in which packet messages can be directed from anyone of a plurality of sending devices to one or more receiving devices, the receiving devices adapted for receiving such packet messages and for responding thereto, the method comprising the steps of: 
 receiving packet messages over a network where each such packet can travel to locations defined according to address information contained within each such packet and wherein each said packet is routed along temporal paths by routers operating under partial control of said address information in solo packets at a particular location in said network;    gathering information pertaining to the operation of said particular location; and    modifying the data flow with respect to said particular location depending upon said gathered information.    
     
     
         34 . The invention set forth in  claim 33  wherein said gathered information is selected from the list containing: 
 number of arriving packets in a particular time interval;  
 the type of requests contained within given packets;  
 the nature of the informational content of the packets;  
 the sending identity of the packets;  
 the response destination of the packets;  
 the traffic patterns formed by packets from specific sources;  
 the number of arriving packets from specific sources;  
 certain data contained in one or more messages; and  
 the type of file attached to a message.  
 
     
     
         35 . The invention of  claim 33  wherein said gathering step includes the step of: 
 gathering information based upon certain pre-established criteria.  
 
     
     
         36 . The invention of  claim 35  wherein said pre-established criteria are dynamically changeable.  
     
     
         37 . The invention set forth in  claim 35  wherein said pre-established criteria are changed manually.  
     
     
         38 . The invention set forth in  claim 33  wherein said gathering step includes the step of: 
 comparing said gathered information to statistics generated from said particular location over a period of time.  
 
     
     
         39 . The invention set forth in  claim 38  wherein said statistics are gathered to reflect normal particular location behavior over a period of time.  
     
     
         40 . The invention set forth in  claim 38  wherein said gathering step includes the step of: 
 comparing said gathered information to expected parameters of said particular location.  
 
     
     
         41 . The invention set forth in  claim 33  wherein said data flow modification is selected from one or more of the following list: 
 storing certain packets for a period of time so as to delay said stored packets from reaching said receiving device for said period of time;  
 blocking certain packets from reaching said receiving device;  
 blocking all packets from reaching said receiving device;  
 rerouting certain packets to another receiving device;  
 modifying the informational content of certain ones of said packets;  
 unblocking certain hitherto blocked packets, on the basis of certain parameters; and  
 modifying the informational content of certain ones of said packets.  
 
     
     
         42 . The invention set forth in  claim 33  wherein said gathering step includes the step of: 
 storing information pertaining to received ones of said packets.  
 
     
     
         43 . The invention set forth in  claim 33  wherein said gathering step includes: 
 monitoring packets leaving said particular location.  
 
     
     
         44 . The invention set forth in  claim 41  wherein said modifying occurs at a gateway router associated with said particular location.  
     
     
         45 . The invention set forth in  claim 41  wherein said modifying occurs at a router remote from said particular location.  
     
     
         46 . The invention set forth in  claim 33  wherein said gathered data is useful for providing information about the history of said packets.  
     
     
         47 . The invention set forth in  claim 33  wherein said method includes the step of: 
 storing said gathered data.  
 
     
     
         48 . A method for controlling data flow in conjunction with at least one node of a multi-node communication network operational for passing data between nodes of said network in accordance with address information associated with packets, said method comprising the steps of 
 reviewing certain parameters pertaining to data flowing between nodes of said network;    comparing said monitored parameters against stored criteria; and    feeding data traffic affecting signals to one or more of said nodes under at least partial control of said comparing step.    
     
     
         49 . The invention set forth in  claim 48  wherein said stored criteria are dynamically changeable.  
     
     
         50 . The invention set forth in  claim 49  further including the step of: 
 storing certain of said monitored parameters for a period of time, at least some of said stored parameters being useful in determining at least a portion of the communication history of said reviewed data.  
 
     
     
         51 . The invention set forth in  claim 48  wherein at least one of said nodes to which traffic affecting signals are fed is said one node.  
     
     
         52 . The invention set forth in  claim 51  wherein said one node is a gateway node to an enterprise system.  
     
     
         53 . The invention set forth in  claim 52  wherein said method is practiced at least in part within said enterprise system.  
     
     
         54 . A monitor system for use in conjunction with a particular site on a communication network; said site arranged to receive data addressed thereon via a network control device associated with said site and to send out onto the communication network via said control device data addressed to other communication network sites; said monitor system comprising: 
 at least one system for tracking data flow situations within said particular site, said data flow situations selected from one or more of the following list: amount of arriving data in a particular time interval; the type of requests contained within given data; the nature of the informational content of the data; the sending identity of the data; the response destination of the data; the traffic patterns formed by data from specific sources; the amount of arriving data from specific sources; and identification of a specific data pattern; and    wherein said tracking system sends arriving data to data storage for a period of time, said time being dependent, in part, upon said tracked data flow situations.    
     
     
         55 . The invention set forth in  claim 54  wherein said tracked data flow situations are, in part, dependent upon comparisons with a pre-established set of parameters.  
     
     
         56 . The invention set forth in  claim 55  wherein said parameters are dynamically changing.  
     
     
         57 . The invention set forth in  claim 55  wherein said parameters are based on statistical data gathered over a period of time with respect to the operation of said particular site.  
     
     
         58 . The invention set forth in  claim 55  wherein said parameters are established from time to time manually.  
     
     
         59 . The invention set forth in  claim 55  wherein said parameters are received from a database.  
     
     
         60 . The invention set forth in  claim 54  wherein said data flow tracking system includes means for gathering information pertaining to certain of said data arriving at said particular site; said data to be gathered being useful for providing information about the history of said data.  
     
     
         61 . The invention set forth in  claim 60  wherein said last-mentioned gathered data is stored for future use.  
     
     
         62 . The invention set forth in  claim 60  wherein said last-mentioned gathered data is selected according to a set of parameters pertaining to operation of said particular site.  
     
     
         63 . The invention set forth in  claim 55  wherein said data flow is effected by controlling data through a gateway unique to said particular site, said data flow controlled, at least in part, by instructions sent dependent upon said comparison.  
     
     
         64 . The invention set forth in  claim 55  wherein said data flow is effected by controlling data through one or more nodes remote from said particular sites, said data flow controlled, at least in part, by instructions sent dependent upon said comparison.  
     
     
         65 . The method of controlling data flow in a communication system in which packet messages can be directed from anyone of a plurality of sending devices to one or more receiving devices, the receiving devices adapted for receiving such packet messages and for responding thereto, the method comprising the steps of: 
 receiving packet messages over a network where each such packet can travel to locations defined according to address information contained within each such packet and wherein each said packet is routed along temporal paths by routers operating under partial control of said address information in solo packets at a particular location in said network;    gathering information pertaining to the operation of said particular location; and    modifying the data flow with respect to said particular location depending upon said gathered information, said modification step including the step of storing certain of said received packets in a data base for future delivery to said defined address.    
     
     
         66 . The invention set forth in  claim 65  wherein said gathered information is selected from the list containing: 
 number of arriving packets in a particular time interval;  
 the type of requests contained within given packets;  
 the nature of the informational content of the packets;  
 the sending identity of the packets;  
 the response destination of the packets;  
 the traffic patterns formed by packets from specific sources;  
 the number of arriving packets from specific sources;  
 certain data contained in one or more messages; and  
 the type of file attached to a message.  
 
     
     
         67 . The invention of  claim 65  wherein said gathering step includes the step of: 
 gathering information based upon certain pre-established criteria.  
 
     
     
         68 . The invention of  claim 67  wherein said pre-established criteria are dynamically changeable.  
     
     
         69 . The invention set forth in  claim 67  wherein said pre-established criteria are changed manually.  
     
     
         70 . The invention set forth in  claim 65  wherein said gathering step includes the step of: 
 comparing said gathered information to statistics generated from said particular location over a period of time.  
 
     
     
         71 . The invention set forth in  claim 70  wherein said statistics are gathered to reflect normal particular location behavior over a period of time.  
     
     
         72 . The invention set forth in  claim 70  wherein said gathering step includes the step of: 
 comparing said gathered information to expected parameters of said particular location.  
 
     
     
         73 . The invention set forth in  claim 65  wherein said gathering step includes the step of: 
 storing information pertaining to received ones of said packets.  
 
     
     
         74 . The invention set forth in  claim 65  wherein said gathering step includes: 
 monitoring packets leaving said particular location.