IP Data Records (IPDR) Generation Engine

The continuous increase in the network bandwidth and the volume of data along with proliferation of new network security threats have enforced Cyber Security professionals to adapt to more smart approach for cyber defense to build network intelligence gathering and analysis tools. These tools require to be based on smart and fast network monitoring to safeguard against cyber threats by detecting breaches faster with activity behavior analytics and use of applications to recognize anomalies in traffic flows rather that capturing and analytics of complete traffics contents.

IP Data records (IPDRs) based cyber threat analytics tools are latest trend in industry that strengthens Cyber Security solutions by providing behavioral context to traffic monitoring. IPDR based analysis tools help in quickly identifying behavioral patterns for network hosts or users and establish contents as good or malicious patterns in their network activities. IPDRs based analysis tools require reduced data storage in comparison to full packet capture based monitoring tools and enables analysts to query and investigate data in fast and more effective ways.

Proposed IPDR Generation and Provision engine is a specialized metadata provisioning platform built upon high speed DPI Core engine. It provides a comprehensive set of IPDRs of different types including aggregated as well as direction-wise packet statistics, L-7 protocol aware traffic statistics, 5-tuple UDP/TCP/IP records and many other types of IPDRs. Example IPDRs include Source port, destination port, client port, server port and L-7 protocol based 5-tuple IPDRs for UDP/TCP/IP protocols, URL, browser, cookies, URI, referrer and other fields based IPDRs for HTTP traffic, user location, quality of service (QoS) metrics, time and duration fields based IPDRs for GPRS Tunneling Protocol (GTP) and caller, callee, audio codec info based IPDRs for SIP protocol based VoIP calls.

Benefits of IPDRs Generation and provisioning engine for developing Cyber Security application include:

• Provisioning multiple protocol and L-7 application attributes as required for respective security analytics after classification and decoding of network protocols from L4-L7 packet data.
• Information extraction capability from traffic in real-time without the need for complete aggregation and storage of packets data that makes security analytics more precise, faster and easier to use than complete raw packets data logs
• Reduced storage requirements in comparison to complete packet data storage based approach.