Abstract: The method enables realtime establishment and maintenance of a standard of operation for a data communications network. The process begins by monitoring the network over some period of time to build benchmark data sets. The benchmark data sets contain a standard of operation for the network, which is historically categorized by either traffic type or activity. This standard of operation is accumulated by the intelligent monitoring facilities. After a period of accumulation, the benchmark is used to determine whether data taken from current monitoring activity indicates normal network behavior. Network monitoring information is analyzed using criteria in modules that have an interface to an expert system. The criteria modules evaluate the current monitored data against the prior benchmark collected data. The criteria module determines if the current network operating characteristics are outside the bounds of normal behavior. If they are, then alerts and logs of information can be sent to the expert system.

Abstract: A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.

Abstract: A system and process are disclosed that allows the collection of events to be organized and ordered so that relationship between events and the events themselves can be identified as a state or series of states which describe and allow control of performance aspects of protocol activity. The architecture allows dynamic programming of multiple of devices for the purposes of coordination and correlation of events such that monitoring, performance analysis and control can be accomplished on a real-time basis for any speed network. The architecture facilitates feedback of the correlated events for the purposes of monitoring and controlling network activity.

Abstract: An Event Driven Interface (EDI) is disclosed for use as a subsystem of a monitoring and control system for a data communications network. The network communicates a serial stream of binary bits having a characteristic pattern. The system includes a control vector generator for generating a control vector C(i) which describes the characteristic pattern and an event vector analyzer for analyzing an event vector E(i) which represents a plurality of occurrences of the pattern on the network.