SYSTEMS AND METHODS FOR SCALABLE NETWORK MONITORING

摘要

A network security device may gather a large amount of metadata pertaining to the connections being managed thereby. A refinement module may filter and/or aggregate the connection metadata. The metadata may be refined on the network security device. The refined metadata may be provided for display on a terminal. The refined metadata may include a subset of the larger connection metadata, which may reduce the overhead required to display and/or transmit monitoring information to the terminal device. The refined metadata may comprise connection groups, which may be formed based on aggregation criteria, such as connection source, destination, application, security policy, protocol, port, and/or the like. The connection groups may be ranked in accordance with ranking criteria.

主权项

1. A system comprising:
a network security computing device comprising a processor and computer-readable storage medium, the network security device communicatively coupled to an internal network and an external network, wherein the network security device is configured to manage a plurality of connections between entities in the internal network and entities in the external network; a monitoring module embodied on the computer-readable storage medium and executable by the processor to acquire connection metadata describing the respective connections; a refinement module embodied on the computer-readable storage medium and executable by the processor to determine refined metadata from the connection metadata, wherein the refined metadata comprises a subset of the connection metadata; and an interface module embodied on the computer-readable storage medium and executable by the processor to generate an interface to display ordered groups corresponding to the refined metadata, wherein the connection groups are sized in the interface according to a weight assigned to the respective connection groups.