CROSS REFERENCE TO RELATED APPLICATIONS

[001] The present invention claims priority from U.S. provisional patent application number 61/931,951, filed January 27, 2014, and is related to U.S. Patent Application

No. (Docket No. 3899.011D) , entitled "SYSTEM AND METHOD FOR NETWORK

TRAFFIC PROFILING AND VISUALIZATION," co-filed herewith on January 27, 2015, which are hereby incorporated herein by reference in their entirety.

FIELD OF INVENTION

[002] The Invention relates generally to systems and methods for profiling network traffic on field area networks.

BACKGROUND OF INVENTION

[003] A Smart Grid is a modernized electrical grid that uses analogue or digital information and communications technology to gather and act on information, such as information about the behaviors of suppliers, consumers, and equipment in the generation, transmission, and distribution networks, in an automated fashion to improve the efficiency, reliability, economics, and sustainability of the production and distribution of electricity. As the grid and its operations become more automated, there is greater dependence on a secure and reliable network to support real-time communications between backend control systems and field nodes and among field nodes. Monitoring the state and health of the network and its components are essential. Monitoring SmartGrid networks presents new challenges that are not present when monitoring more traditional networks. [004] Smart Grid networks cannot be monitored using existing enterprise network monitoring solutions because field networks use a widely distributed wireless network, a combination of non-standard and energy-specific protocols, and new forms of networking technology not supported in enterprise or carrier environments. For instance, enterprise solutions designed to monitor Internet protocol (IP) traffic cannot process the proprietary packets transmitted over the air in the field. They do not understand the mesh networking technology that enables packet relaying, the unique and asymmetric routing protocols, the peer-to-peer transport mechanisms and the broadcast technologies used in today's Advanced Meter Infrastructure (AMI) networks. Wireless FANs further contain a large number of radio channels with concurrent communications, where nodes hop in both frequency and time, making it difficult for traditional systems to track the full communications of a node. Whereas traditional enterprise monitoring systems are located at a central point in the infrastructure, typically a point between the external internet and the internal network, there is no equivalent point in many Smart Grid field area networks (FANs). Only select traffic, for instance, gets sent back through a central point to management systems. The bulk of the traffic in the FAN is not visible to backend systems. Smart Grid field area networks are also much larger than the largest enterprise networks. A Smart Grid AMI network may contain 5 million nodes, whereas the largest enterprise networks contain one to two orders of magnitude fewer devices.

[005] In addition, the real-time nature of utility control systems requires that any monitoring system does not affect or interfere with the performance of the control network or endpoint, i.e., The monitoring system must be non-intrusive. The process of requesting millions of endpoints to provide status information on a frequent basis and backhauling responses or packet intercepts over the same network which would typically be done in an enterprise environment is not practical as it would create immense traffic congestion on low bit-rate wireless networks and burden the endpoint with additional processing, thereby greatly inhibiting energy operations.

[006] Due to these limitations, utilities that have deployed AMI and Distribution

Automation (DA) networks in recent years have almost no visibility into the operation of their wireless mesh networks. A utility's ability to monitor field networks typically stops at access points and collectors, leaving utilities unable to directly monitor wireless field communications among nodes in a field network. At best, current practice relies on limited disjoint information obtained by querying a few individual wireless nodes for network statistics. This practice is not scalable nor does it provide a real-time network view. Nodes cannot be queried continuously in-band because the traffic would create network congestion. Even AMI and DA vendors who offer network management services are not able to directly monitor the mesh as part of their service.

SUMMARY OF INVENTION

[007] Embodiments of the present invention include a computer system, method, and computer program product that perform traffic analysis, including but not limited to, arbitrary real-time network traffic analysis and multi-indicator visualization, with specific applications to wireless mesh networks and Smart Grid traffic by utilizing a distributable, scalable adaptive real-time system. Although embodiments of the present invention have specific applications to wireless mesh networks and Smart Grid, one of skill in the art will recognize that they are also adaptable to different network environments.

[008] In a further aspect of the invention, an embodiment of the present technique consumes and processes multiple streams of real-time wireless mesh traffic intercepts from multi-channel field probes using a parallel architecture to create sets of real-time indicators, including but not limited to, indicators for network health, security, revenue protection, privacy and configuration validation.

[009] In a further aspect of the invention, an embodiment of the present technique provides insightful results using traffic analysis techniques by processing non-standard protocol elements and encrypted traffic.

[0010] In a further aspect of the invention, an embodiment of the present technique monitors network traffic by tapping into field in live traffic feeds destined to be processed by an intrusion detection system and allows filtering of fields already defined by a packet dissector to be used as components of a network health indicator. I n embodiments of the present invention, the system and method combines multiple fields from an intrusion detection system and a packet dissector into complex indicators, either from the same probe or multiple probes.

[0011] In a further aspect of the present invention, an embodiment of the present technique utilizes indicators or traffic from multiple probes to create multi-level views, including but not limited to, a global network view [i.e., all probes), a service area view (i.e., a series of probes within a service area), an Access Point view [i.e., a probe near a specific access point) and a specified node [e.g., a meter). In this embodiment, the multiple levels of monitoring enable system operations to establish quickly the state of their wireless field area network at any instant and drill-down to isolate network health, security, revenue, privacy and configuration issues to a service area , an access point subnet, and even to a particular node.

[0012] In a further aspect of the present invention, an embodiment of the present technique utilizes an out-of-band transport channel to collect traffic and metadata to avoid creating congestion on bandwidth constrained, mesh-based field area networks.

[0013] In a further aspect of the present invention, an embodiment of the present technique applies timestamps to each packet, and/or utilizes timestamps applied by a packet interceptor, during intercept, in order to faithfully reproduce the actual timeline, negating the effects of delays in backhaul connectivity, differential delay in packet streams from multiple probes and temporary backhaul connectivity loss that would cause the flow in traffic streams being processed by this technique not to match the actual traffic flow in the network being monitored.

[0014] In a further aspect of the present invention, an embodiment of the present technique processes live data feeds taken from one or more traffic probes, including but not limited to, both passive and active traffic probes, in Smart Grid field area networks in real-time and maintains the original packet timeline. [0015] In a further aspect of the present invention, an embodiment of the present technique processes live data feeds from a traditional network monitoring point near-end systems to monitor backend Smart Grid traffic in real-time.

[0016] In a further aspect of the present invention, an embodiment of the present technique selects predefined fields from packets to create a set of simple or compound indicators with multi-level views across the network.

[0017] In a further aspect of the present invention, an embodiment of the present technique performs detailed and flexible analyses on traffic flows in order to compute aggregate statistics to assess performance and network health.

[0018] In a further aspect of the present invention, an embodiment of the present technique enables each indicator to operate on its own independent timescale for fast and slow responsiveness.

[0019] In a further aspect of the present invention, an embodiment of the present technique enables indicators to be distributed across multiple processors in a server, multiple servers, and multiple processors/servers for intensive individual indicators with the results combined to create an integrated dashboard.

[0020] In a further aspect of the present invention each indicator can be configured to operate on its own independent timescale for fast and slow responsiveness to changes in traffic patterns.

[0021] In a further aspect of the present invention, an embodiment of the present technique visualizes and monitors the indicators through a web-based dashboard where each instance can use its own choice of graphing presentation for the same data. Each user has the ability to select indicators of interest and indicator layout which can be saved and reconstituted upon future access. [0022] In a further aspect of the present invention, an embodiment of the present technique utilizes indicator graphs to maintain the original intercept timeline and represent data according to that timeline, instead of utilizing a local timeline based on traffic stream flow.

[0023] In a further aspect of the present invention, an embodiment of the present technique issues alarms on traffic anomalies and adapts alarm thresholds and alert triggers to changes in traffic flows over time.

[0024] In a further aspect of the present invention, an embodiment of the present technique allows a user to playback a packet trace file to recreate the indicators for a past sequence of time.

[0025] In a further aspect of the present invention, an embodiment of the present technique supports a database to record historical values for each indicator and allows a user to define a period of time in the past to view for analysis.

[0026] In a further aspect of the present invention, an embodiment of the present technique can be scaled to support large traffic volume from a multitude of probes.

BRIEF DESCRIPTION OF DRAWINGS

[0027] The foregoing and objects, features, and advantages of one or more aspects of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:

[0028] FIG. 1 depicts one example of an aspect a computing environment used to execute one or more aspects of an embodiment of the present invention;

[0029] FIGs. 2_ 1Λ 1ΛΛ depict examples of aspects of a Smart energy computing environment.

[0030] FIG. [[2]] 4 depicts one embodiment of a single processor computing environment to incorporate and use one or more aspects of the present invention; and [0031] FIG. [[3]] 5 depicts one embodiment of a computer program product incorporating one or more aspects of the present invention.

[0032] FIG. [[4]] 6 depicts aspects of a dataflow model of an embodiment of the present invention.

[0033] FIG. [[5]] 7 depicts aspects of a dataflow model with traffic feed aggregation of an embodiment of the present invention.

[0034] FIG. [[6]] 8 depicts aspects of a technical architecture of an embodiment of the present invention.

[0035] FIG. [[7]] 9 depicts aspects of a workflow of an embodiment of the present invention.

[0036] FIG. [[8]] 10 is an example of a configuration file utilized in an embodiment of the present invention.

[0037] FIGs. [[9-12]] 11-25 are examples of visuals produced by embodiments of the present invention.

[0038] FIG. [[13]] 26 is an example indicator definition utilized in an aspect of the present invention.

[0039] FIGs. [[14-39]] 27-52 depict examples of visuals produced by embodiments of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

[0040] Embodiments of the present invention perform traffic analysis, including but not limited to, arbitrary real-time network traffic analysis, and indicator visualization, including multi-indicator visualization, with specific applications to wireless mesh networks and smart grid traffic by utilizing a distributable, scalable adaptive real-time system. Embodiments of the present invention can be utilized together with the packet acquisition and intrusion detector systems disclosed in U.S. Patent Application No. 13/769,133, filed February 15, 2013, entitled "Method and System for Packet Acquisition, Analysis and Intrusion Detection in Field Area Networks," incorporated herein by reference in its entirety. Embodiment of the present invention can also be utilized together with the multi-function electric meter adaptor and methods disclosed in U.S. Patent Application No. 13/769,111, filed February 15, 2013, entitled "Multi-Function Electric Meter Adaptor and Method for Use," incorporated herein by reference in its entirety. Embodiments of the present invention can also be utilized with the network analysis and visualization tools disclosed in U.S. Patent Application No. 14/163,547, entitled "Method and System for Visualizing and Analyzing a Field Area Network," incorporated herein by reference in its entirety.

[0041] Embodiments of the present invention constitute a novel approach to processing, analyzing, visualizing and profiling traffic in field area networks. Monitoring FAN traffic presents several challenges that are not addressed in traditional network monitoring systems. To monitor traffic, network traffic needs is intercepted at multiple locations, over multiple radio channels and processed collectively and individually. In FAN networks, in-band Transport of the traffic and metadata back to a processing center is not feasible given the limited capacity of the service network and need to avoid impacting energy operations.

Variable transport delays and intermittent connectivity in the backhaul creates multiple streams that are not synchronized and may occasionally exhibit gaps when connectivity is lost. To address these challenges, embodiments of the present invention reuse processed traffic streams meant for an intrusion detection system, including but not limited to that disclosed in U.S. Patent Application No. 13/769,133, which buffers and later uploads traffic when connectivity is restored. Embodiments of the present invention additionally comprise protocol dissectors to monitor proprietary communications, network indicators for network health, security, revenue protection, privacy, and configuration validation, and a scalable processing architecture to handle multiple live streams and process packets for individual indicators on multiple processors and servers. Embodiments of the present invention also utilize packet timestamps applied at intercept instead of local processing time to maintain the original packet timeline. Maintenance of an original packet timeline enables embodiments of the present invention to playback historical traffic traces at an accelerated rate, while maintaining the original timeline in the indicators.

[0042] Embodiments of the present invention offer a number of advantages over known network monitoring systems and techniques. Embodiments of the present invention capture, perform analyses on, and report on aspects of traffic traversing a FAN. Embodiments of the present invention utilize independent probes rather than relying on the network nodes themselves to report traffic statistics. Thus, embodiments of the invention do not affect the performance of network nodes and provide independence as a supply chain integrity benefit with the ability for one system to independently monitor another system. In embodiments of the present invention, the capture of packets/traffic does not affect the performance of the mesh network because this traffic is transported out-of-band. Embodiments of the present invention provides real-time network statistics based on live feeds. Embodiments of the present invention integrate with an IDS, including by not limited to, the IDS disclosed in U.S. Patent Application No. 13/769,133.such as that disclosed in as these embodiments reuse traffic feeds meant for an IDS. Embodiments of the present invention utilize filterable fields predefined in protocol dissectors and a set of operators to enable users to construct logical expressions for simple, compound and multi-level network indicators across a multitude of probes, while enabling simultaneous display and update of each indicator on independent time scales. Embodiments of the present invention enable the creation of historical baselines, which embodiments of the present invention apply to determine if a given network is operating within control limits. In embodiments of the present invention, indicator timeframes can be configured for short or long durations for fast response to immediate problems and slower response for long term trends. In embodiments of the present invention, these indicators can be updated and changed to help develop a set of orthogonal indicators, i.e., indicators that do not all react to the same problem to help facilitate problem identification. Embodiments of the present invention utilize timestamps to maintain the original packet timeline. Thus, historical views of indicators can be recalled for a defined period and historical packet traces can be played back at an accelerated rate to regenerate network indicators for a historical time period, while maintaining the original timeline.

[0043] Embodiments of the present invention enable Smart Meter and Distribution

Automation Smart Grid network activity at the lowest levels of communication to be made viewable to network operations, engineering, security, and troubleshooting personnel. Thus, network performance, health and security can be instantly determined from a set of predefined charted indicators with threshold and behavior controls, enabling utility operators to detect Field Area Network problems in a matter of minutes, rather than waiting for the status of a meter read job that is performed every 4 to 6 hours. As aforementioned, historical baselines can be created and applied to determine if the network is operating within control limits. Thus, equipment misconfigu ration or failures can be detected and repair teams sent out before impacting power network operations in the case of DA and meter billing in the case of Smart Meters. Thus, security, revenue protection, and privacy are enhanced by quick detection of anomalous activity.

[0044] As aforementioned, the techniques of aspects of the invention described herein are specifically applicable to SmartGrid networks because certain aspects are adaptable and enable a user of an embodiment of the invention to overcome challenges that are unique to these types of technical environments. However, aspects of the invention may be applicable in more traditional environments. Thus, FIG. 1 depicts a more traditional computing environment in which aspects of the present invention are applicable. Meanwhile, FIGs. [[1A-1AA]] 2^3 depict more specialized aspects of technical environments in which embodiments of the present invention are especially applicable and necessary in order to achieve the traffic profiling described herein.

[0045] FIG 1 is a computing environment 100 used to execute one or more aspects of an embodiment of the present invention. In this embodiment, a computer system 110, which can include a cloud and/or an enterprise system, is accessible by one or more terminals 120a-120e. Computer system 110 can also be a single computer resource. The terminals access the one or more resources of the computer system 110 via a network connection 130, including but not limited to a LAN, a WLAN, and/or an Internet connection.

[0046] In this embodiment, computer system 110 contains one or more servers, such as web or application servers, that serve content to the terminals 120a-120e over the network connection 130.

[0047] In this embodiment, each of the terminals 120a-120e includes at least one processor (not pictured) and at least one memory resource (not pictured). The terminals 120a- 120e are capable of executing a client program on the terminals 120a-120e, including but not limited to a thin client, proprietary client, or a web browser , which users of the terminals 120a- lOe utilize to interact with a client application 140 executed on one or more resources of the computer system 110. In this embodiment, the client application 140, which is comprised of computer readable program code, is depicted as residing on one of the resources of the computer system 110. The terms "computer readable program code" and software are used interchangeably and both refer to logic executed by processing circuits on computer resources.

[0048] In further embodiments of the present invention, the client application 140 is installed on one or more resources of the computer system 110 and/or one or more computer resources accessible to one or more resources of the computer system 110. In a further embodiment of the present invention, the client application 140 is web-enabled with a back end server, as opposed to being an installed client.

[0049] An embodiment of the present invention also includes a computer program product executed by a processor on one or more computers.

[0050] Technical architectures utilized by embodiments of the technique are disclosed in U.S. Patent Application No. 14/163,547, and specifically in FIGs [[1-2111 and 4. As

aforementioned, this application is incorporated herein by reference in its entirety.

[0051] Returning to FIG 1, in an embodiment of the present invention, client application

140 is installed on one or more resources of the computer system 110 and/or one or more computer resources accessible to one or more resources of the computer system 110. This exemplary embodiment is utilized merely to illustrate an embodiment of the present technique. The computer program code utilized in aspects of the present technique to perform a method, when executed by a processor, internal or external to a computer system 110, can be housed on a memory device that can be either internal or external to a physical machine (or multiple physical machines) executing the computer program code.

[0052] Throughout the application, portions of the program code that comprise embodiments of the invention may be referred to as modules. The modular representation of embodiments of the invention is offered just as an example and for ease of understanding. One of skill in the art will recognize that the structure of the actual program code can vary across embodiments while maintaining consistent functionality as disclosed herein.

[0053] Referring now to FIG. [[1A]]2, as aforementioned, FIG. [[1A]]2 depicts a technical environment in which aspects of the present system and method are applicable. Specifically, FIG. [[1A]]2 is a wireless Smart energy network 100, including but not limited to an AMI network, that includes one or more backend management systems 140 connected to a multitude of access points 120a-120n and a number of meters 130a-130n, both in the field area network 110.

[0054] To analyze the traffic in the FAN 110, a number of probes intercept traffic. As seen in FIG. [[1A]]2, a number of probes 150a-150n reside in various placed in the field area network 110, but there is also a probe 150a-150n in the backend 140 at a centralized point where the access points 120a-120n connect. To analyze the traffic on the Smart energy network 100 without interfering with the operation of the Smart energy network 100, for example, without burdening the network, a second network 160 connects to the probes 150a- 150n to backhaul intercepted traffic from the probes 150a-150n to a traffic profiler system 170. As will be discussed in further detail, the second network 160 may be understood as a backhaul network, including but not limited to, a WAN. [0055] FIG. [[1AA]]3 is a more detailed view of the traffic profiler system 170 from FIG.

[[1A]]2. This traffic profiler system 170 includes a collector pre-processor 171, a traffic aggregator 172, individual indicator group processors 173a-173n, one or more databases 174 connected to each processor, and a web server 175 that connects to the database 174. As will be described in more detail later in the application, the group processors 173a-173n obtain multiple streams from the collector pre-processor 171 and the traffic aggregator 172. In an embodiment of the present invention, different types of indicators are grouped together and processed using multiple processing resources in separate streams to increase the efficiency of the system. Once processed, the results can be retained in more than one database 174 or other memory resource. In order to obtain a visual of the indications from the indicators, a user may connect to the web server 175 via a client 180 and responsive the a request from the client and/or automatically, the code executed by the web server and/or the client may utilized the connection between the web server 175 and the database 174 to pull retained results and create visual representations of the results that are viewable on the client, including but not limited to, indicator charts.

[0056] In an embodiment of the present invention, the software saves indicator charts created by software executing in the group processors 173a-173n in the database 174 and software updates the collection of indicator charts in real-time every time there is an update to the web server 175.

[0057] FIG. [[4[]]6 is a dataflow model of an embodiment of the present invention. As aforementioned, embodiments of the present invention obtain the same live traffic feed as is fed into the SecureSmart IDS (Intrusion Detection System), which is described in U.S. Patent Application No. 13/769,133. For each field probe in the system, the dataflow is as follows: a field probe actively and/or passively collects data packets that are intercepted over the air, data is transferred via a backhaul network, including but not limited to a WAN, and in embodiments of the present invention, utilizing a Secure VPN, to a backend server, computer program code executing on a processor (in embodiments of the present invention referred to as a Collector module) pre-processes the data, descrambling and processing headers, and the processed data flows downstream and is obtained by various software applications, including the TrafficProfiler, which is described in this application, Live Feed, IDS and Capture Repository.

[0058] Embodiments of the present invention produce metrics based on data input from multiple probes. These probes are described in U.S. Patent Application No. 13/769,133. In an embodiment of the present invention, computer program code executing on at least one processor combines two or more output streams into a single stream. This functionality of the computer program code can be understood at a "Traffic Aggregator" module.

[0059] Referring to FIG.. [[5]]7, in an embodiment of the invention, that depicts the flow of network traffic from field probes and its flow through the Traffic Aggregator software module to the TrafficProfiler software module. As aforementioned, the modular

representation of the software is utilized for ease of understanding. In FIG. [[5]]7, computer program code executing on one or more processors referred to as a "Traffic Aggregator" module obtains the output from a probe by making a connection, including but not limited to a UDP or TCP connection, to an application that collects and pre-processes each output stream, referred to in FIG. [[5]]7 as Collector Pre-Processor(s). The Traffic Aggregator software then drops the global header [e.g., LibPCAP) from each output stream. The Traffic Aggregator receives requests from consumers, via the TrafficProfiler software module, and sends a combined output stream (with LibPCAP global header prepended) to the TrafficProfiler software executed by one or more processors.

[0060] FIG. [[6]]8 is a high level representation of the software architecture of the aforementioned TrafficProfiler module. In this embodiment, all components are fully modular and expandable through the use of plugins. Plugins are derived from base classes which implement basic functionality and means to communicate with other modules. Several input, analysis and output modules are included. In this embodiment, the various modules of the computer program code find each other on-the-fly using Python's introspection features and load dynamically at runtime. The analysis components are event-driven. [0061] Referring to the embodiment of FIG. [[6]]8, functionality of the computer code is segmented within core modules (InputStream, StreamAnalyzer and OutputStream). These modules communicate with one another using callbacks. The modules use these callbacks to form a workflow that process packets from transmission to reporting.

[0062] A basic workflow of an embodiment of the present invention is depicted in FIG.

[[7]]9. In the embodiment of FIG. [[7]]9the computer program code executing at least one processor and taking as input received packets, which were intercepted by a traffic interception system. The computer program code parses the packets, analyzes the packets based on configured indicators, and reports the result of the analysis.

[0063] In an embodiment of the present invention, indicators and workflow can be described in intuitively structured configuration files, which can be edited directly by the user or through a graphical interface. FIG. [[8]]10 is an example of such a configuration file.

[0064] As aforementioned, an embodiment of the present invention utilizes core modules InputStream, StreamAnalyzer and OutputStream to profile intercepted traffic from a FAN. In this embodiment, and as seen in FIG. [[7]]9, the InputStream module obtains a packet. The InputStream module receives packets through one or more streams, such as UDP or TCP and in one or more formats, including by not limited to PCAP and PDML. When TCP or UDP is utilized, it receives packets directly via a network connection in PCAP format. When PCAP is utilized, it allows a pre-captured file to be replayed through an included utility as though it were live data. Additionally this stream allows replay at variable speeds to quickly reproduce historical charts. When PDML is utilized, it similarly allows a pre-captured file, which has already been dissected and converted to the PDML format, to be ingested for replay at variable speed.

[0065] In an embodiment of the present invention, depending on the source, packet data is either decoded by a packet dissector in order to produce a PDML output of the packet, or passed on directly if already in PDML format. [0066] After a packet is in a PDML format, the InputStream module parses out metadata about the packet. This metadata is then relayed to each registered StreamAnalyzer module for processing.

[0067] As seen in FIG. [[7]]9, the analyses on a packet can be divided among multiple processes to increase packet throughput and support additional indicators. In FIG. [[7]]9, each StreamAnalyzer module is configured to perform a single simple analysis on a packet stream. In further embodiments of the present invention, StreamAnalyzers can be "linked" together to perform more complex analysis, to split and rejoin streams or to direct StreamAnalyzer streams to different OutputStreams.

[0068] As aforementioned, the software analyzes time events by using packet timestamps, which were captured upstream, rather than relying on monitoring the inflow of packets in the stream with a local time base. Delay in backhaul connectivity and temporary backhaul connectivity loss will cause the flow in traffic streams to not match the actual traffic flow in the network being monitored. Thus, by using the packet timestamps, the software can maintain the timeline of the packets in the monitored networks and ensure indicators reflect the original timeline.

[0069] Use of packet timestamps supports the replay aspects of embodiments of the present invention. Packet timestamps, which are recorded at time of capture are the most accurate to use for statistical analysis. Embodiments of the present invention accept historical packet trace files, such as a .pcap files. Upon receiving this file, the software is configured to play back this traffic, at an accelerated rate, to generate indicator charts for that historical period. Even though the playback can be accelerated, the indicators maintain the proper timeline.

[0070] Returning to FIG. [[7]]9, the StreamAnalyzer modules analyze packets and determine whether events are present that indicate state changes. The software reports results based on events. Results include information regarding statistical analysis as well status information tied to the results. In an embodiment of the present invention, some of the status information can be rendered as alerts.

[0071] Status information provides a means for an analyzer to generate messaging through its registered OutputStreams for reporting various events, including but not limited to, anomalies in stream data, and/or state changes.

[0072] In an embodiment of the present invention, a user can utilize a graphical user interface to set thresholds related to events. A default configuration of the software enables a user to set hard thresholds for a test based on current vs. historical data and reports a Red, Yellow or Green status based on the result. In another embodiment of the present invention, the thresholds are related to statistical measurements, such as one or two standard deviations from the mean. In this case, the alerts dynamically track the data.

[0073] In an embodiment of the present invention, status information can be accompanied by a message, which can contain a detailed explanation of the alert. A default configuration of an embodiment of the present invention includes computer program code, that when executed by a processor, reports the time (as reported within the last packet received) , the resulting value(s) of a test and amount of historical data held in state.. The software displays these status messages in a GUI that is a JavaScript-based dashboard.

[0074] In an embodiment of the present invention, updates represent the result(s) of analysis performed by each StreamAnalyzer and flow through the StreamAnalyzer's registered OutputStreams. A default configuration of an embodiment of the present invention includes computer program code that uses these values to build graphs in the aforementioned dashboard.

[0075] Returning to FIG. [[7]]9, each of the analyzers has one or more registered

OutputStream callbacks. Callbacks defined in various embodiments of the present invention include, but are not limited to, CONSOLE, FILE, SQL, TCP, UDP, SMTP and SYSLOG. CONSOLE is used for debugging purposes to simply print updates with status information to standard output. FILE is used to write output to a structured text file (CSV for example). SQL is used to send updates with status information to a MySQL database for historical logging or to preload charts in the JavaScript-based Dashboard. TCP is used to send to a server and port via the TCP protocol. UDP is used to send to a server and port via the UDP protocol. SMTP is used to send to a mail server. SYSLOG is used to send updates with status information to a syslog server for correlation with other network events. In embodiments of the present invention, users can utilize clients, such as those in FIG.. 1, to configure parameters related to an OutputStream callback, which relate to the structure and/or behavior of the OutputStream callback.

[0076] In an embodiment of the present invention, the SQL OutputStream connects to a web server database server which allows connections from any number of SQL OutputStream modules. The OutputStream modules may be distributed across multiple servers. At least one SQL OutputStream will send a registration request with metadata describing indicator charts to the database server. The database server stores this information in a data structure, which is queried by the integrated web server to produce a dynamic HTML and JavaScript dashboard. An example layout is shown [[in]] as FIGs. [[91111-25.

[0077] The charts in FIGs [[9-12]] 11-25 are just examples of possible visual indicators produced by the software. One of skill in the art will recognize that the data, once collected and analyzed in accordance with the techniques of the present invention, can be represented to a user in a GUI in many ways known in the art, such as graphs, charts, reports, etc. As an example, results can be represented in charts that are laid out by flows, as in FIGs. [[911 11-25.

[0078] Utilizing a user interface, a user can interact with the program code to configure and view charts with different aggregations of data. In an embodiment of the present invention, customizable titles include the configured sampling frequency. Also, each chart has a status color, and each aggregate level also has a color, which is the color of the most serious status for any of the underlying charts. The top level also has a status color, which is the color of the most serious status across all underlying aggregates. A status history is kept for each chart and an expanded view reveals a scrollable list of status changes. This list can be sorted and filtered by time and status. In an embodiment of the present invention, program code executed by a processor enables the user to zoom and pan using slider functionality, viewable in FIG 9, in order to explore the data. Redrawing of the chart can be paused while exploring, if desired. Data will continue to feed into the chart while it is paused.

[0079] In an embodiment of the present invention, StreamAnalyzers that include time series analyses can be displayed by the software and subsequently viewed in the dashboard as line/area/column charts. Further embodiments of the present invention may include

StreamAnalyzer modules whose results may be more suited to bubble charts, pie charts, gauges, etc. When utilizing a user interface to configure each StreamAnalyzer, a user can specify the type of chart. Additionally, a user can change any chart in the Dashboard to another type using editing functionality in the software. The software obtains the changes made through the GUI and adjusts the display accordingly.

[0080] FIGs. [[10-121123-25 depict indicator displays generated by the software as results of two different types of stream analyses that can be completed by two different Stream Analyzer modules executed by one or more processors in an embodiment of the present technique. FIG. [[10]]23 depicts a PERCENT StreamAnalyzer charted in the Dashboard, while FIG. [[11]]24 depicts a COUNT StreamAnalyzer charted in the Dashboard, and FIG. [[12]]25 depicts a UNIQ. StreamAnalyzer charted in the Dashboard.

[0081] Referring to FIG. [[10]]23, a PERCENT StreamAnalyzer was used to create an indicator chart in the Dashboard to monitor the percentage of mesh routing advertisements observed in a 600 second analysis window. This visual rendering by the software describes traffic that matches a user specified criteria (filtered field = mesh routing advertisement) over time with a user defined analysis window. The percentage of matched packets vs. unmatched packets in the current sample is shown and the average of the last 10 samples is shown as well.

[0082] Referring to FIG.. [[11]]24, a COUNT StreamAnalyzer was used to create an indicator chart in the Dashboard to monitor the number of Domain Name Server response observed in a 600 second analysis window. This visual rendering by the software describes traffic which matches a user specified criteria (filtered field = DNS response) over time with a user defined analysis window. The count of matched packets in the current sample is shown and the average of the last 10 samples is shown in as well.

[0083] Referring to FIG.. [[12]]25, a UNIQ StreamAnalyzer was used to create an indicator chart in the Dashboard to monitor the number of unique source MAC addresses observed in a 600 second analysis window. This visual rendering by the software describes traffic which matches a user specified criteria (filtered field = a unique source MAC) over time with a user defined analysis window. The count of unique MAC addresses in the current sample is shown and the average of the last 10 samples is shown as well.

[0084] The software updates the collection of indicator charts in real-time every time there is an update to the database. To obtain and apply these updates, a background process always polls one or more database server(s) for more data. In an embodiment of the present invention, the Web Worker specification in HTML is utilized to poll a web server which in turn queries the database. When the server(s) has (have) no data to return it has been specially configured to not let the connection hang, but rather to background it. When the server does have data to return, it sends the data immediately. A process, including by not limited to the Web Worker, parses and forwards data to the program code that interprets the rendering of the GUI and refreshes the indicator charts in the Dashboard. In one embodiment, the main JavaScript event loop in the browser receives and implements the updates to the charts. Upon an update, the process, for example, the Web Worker, immediately initiates a new connection to wait for new data. When the Web Worker is employed, this architecture approximates realtime push notifications over HTML.

[0085] In an embodiment of the present invention, if the server, such as a web server, receives multiple updates between responses to the client (which often happens at high traffic volumes), the server queues the updates and sends them all in a single batch during the next client response. This maximizes the throughput of the system and eliminates the possibility of missed updates. [0086] Lastly, in embodiments utilizing a SQL OutputStream operator, if this operator is in use, charts can preload using data from a computer readable storage medium, such as a database. This way it is not necessary to wait for new data to populate each chart. The number of data points to preload is configurable. Status information as well can be preloaded from the database in the same manner to populate the history of status changes in the Dashboard. In an embodiment of the present invention, the status information can include a history of statuses that rise to a level of alert, as determined by pre-configured thresholds.

[0087] As aforementioned, the present technique can be combined with techniques disclosed in U.S. Patent Application No. 13/769,133 and U.S. Patent Application No.

13/769,111. The former of these applications discusses the functionality of a method, system, and computer program product referred to as "MeshView," which is a FAN network analysis tool. Separate from the traffic analysis disclosed in this application, the overall FAN network intelligence can be increased by utilizing a large database with MeshView to improve application responsiveness. Utilizing the MeshView interface, which is discussed in more detail in U.S. Patent Application No. 13/769,133, on screens such as Sources and Destinations, where a set of database queries are made to determine all unique sources or destinations in the filtered data set, application responsiveness is improved by using a feature called "lazy pagination," which is integrated into the computer code. The code embodying this

functionality, rather than render a single page with thousands of sources or destinations, the query returns the total count in the selection, the first N sources or destinations and a set of links to the remaining sources or destinations, segmented into groups of N. When a link is selected, a new query design to gather the appropriate group of N sources or destinations and their related info is launched. The smaller query significantly reduces database processing time and reduces application latency.

[0088] Code embodying the "lazy pagination" feature is also executed on the Timeline plot in MeshView to significantly improve the performance of the plot and still enable the user to view all the packets. The links to the remaining packets are labeled with the timeframe they represent so that the user can select a group of interest based on time. The smaller query significantly reduces database processing time and reduces application latency.

[0089] The concept of a "heat map" is applied to concisely represent figures of merit for devices within an area on a geographic or satellite map using geographic information system coordinates, where a service area is divided into a collection of polygons that tile the area and the figure of merit is calculated for each geographic tile and the color of the tile is set based on the magnitude of the result. The "heat map" is convenient for conveying the mesh hop count, RF signal level, node connectivity, and node communications activity, among other figures of merit.

[0090] Data segmentation is applied to the MeshView database in whole because large databases are slow to return complex queries. In embodiments of the MeshView technique, at predefined intervals of two or three weeks, the MeshView database is automatically saved and a new instance of the database is created. MeshView users set a timeframe filter, for example, using a part of the Filter page, and the software selects one or more small databases and manage queries to each as appropriate. Alternatively, the user can select a database by a user selection. Performance is greatly improved as a small database with two weeks to two months of packet data (~3 to 30 million packets) is more responsive than a large database that contains multiple years of packet data (~1 b5illion packets).

[0091] As discussed above, embodiment of the present invention define different analysis operations that can be applied to field expressions to indicate certain conditions. In embodiments of the present invention, indicators designed to detect intrusion may also report information about network health. Some indicators have already been discussed, but some embodiments of the present invention define six (6) analysis operators that can be used in field expressions to create a variety of indicators. These six analysis indicators include:

[0092] COUNT (Tally a count of packets or bytes satisfying the field expression over the analysis window. This operator is also used to create traffic utilization charts. [0093] UNIQUE: Tally a count of unique values resulting from the field expression over the analysis window.

[0094] AVERAGE: Calculate the average value of the field expression over the analysis window.

[0095] PERCENTAGE: Calculate a percentage of packets that satisfy the field expression over the analysis window.

[0096] RATIO: Calculate the ratio of packets satisfying a first field expression to a second field expression.

[0097] LATENCY: Calculate the time latency between two packets (typically a request and response) linked by a common ID or sequence number.

[0098] FREQUENCY: Calculate the average time between occurrences of specified events.

[0099] In an embodiment of the present invention, indicator charts are created by selecting an analysis operator to apply to one or more dissected fields extracted from incoming traffic. Dissected fields can be combined using field logic (AND, OR, NOT, etc.).

[00100] FIG. [[13]]26 is an example indicator definition for DA Management and DNS Traffic (Packets). The selected analysis is COUNT. In an aspect of the present invention, the analyzer counts packets satisfying the field expression. The field expression consists of three dissected fields combined with a logic OR. The first dissected field is an IPv6 address to match against either source or destination address in an I Pv6 packet. The second dissected field is an IPv6 prefix to match against the source or destination address of an I Pv6 packet. The third dissected field is an IPv4 address to match against either source or destination address in an IPv4 packet.

[00101] Embodiments of the present invention allow the flexibility of utilizing different indicators depending upon the hardware and software conditions of the network, such as a FAN, upon which traffic is profiled. Certain considerations may affect indicator selection. These conditions include, but are not limited to, window size/type, behavior [e.g., patterned versus spike behavior), visual representation [e.g., chart type). In an embodiment of the present invention a 10-minute window size was selected, but various embodiments of the present invention enable each indicator to have its own time base, allowing for a combination of both fast and slower indicators. In an embodiment of the present invention, to understand behavior indicators that typically have stable (non-zero) states or appear cyclical are utilized in traffic analysis to detect anomalies in normally patterned behavior. Embodiments of the present invention represent indicator results are bar charts, candlestick charts [e.g., for indicators that measure averages or latency), gauges [e.g., for indicators that might have fixed thresholds).

[00102] In an embodiment of the present invention, the program code executing on at least one processor creates automatic baselines and learns, for example, by storing a configurable amount of state for each indicator during its learning phase. Once a state is filled, it is used as the baseline for future traffic. In an embodiment of the present invention bucketing of information data was applied in the formation of indicator baselines. Bucketing groups data for a specific indicator by hour of day, day of week, or day of year (or any combination of the three) and is configured on a per-indicator basis. For indicators that peaked and fell at predictable times, it made sense to bucket hourly. This means that analysis results for these indicators computed at a particular hour of the day were compared only with baseline values computed during that same hour of day. Day of week bucketing may be for indicators that peaked and fell based on a particular day of the week. Combining hourly and day of week may group together results that happened on a particular week day at a particular time.

Monthly bucketing may work similarly. Some embodiments of the present invention use four hourly bucketing cycles to detect 4-hour meter reads.

[00103] In an embodiment of the present invention, a baseline state for each indicator may be stored as a simple text file. As a text file, the state information can be modified or regenerated manually and provide the flexibility to import baseline data using alternate methodologies, which could potentially improve anomaly detection.

[00104] As aforementioned, indicators utilized by embodiments of the present invention may vary; however, in an embodiment of the present invention, forty-two (42) indicators have been identified as key indicators to monitor the FAN health of select AMI and DA networks. In the aforementioned embodiment, the exemplary 42 indicators can be organized into seven (7) indicator affinity groups as shown in the Table 1 below. Indicators are executed by the program code as described in conjunction with the described technical environment.

Table l

Indicator Grcu Indicate ir AMI DA

Traffic

FAN Traffic FAN Traffic Composition - Protocol x x

FAN Traffic Composition - Protocol (No

X

Overhead) x

Total FAN Traffic (Packets) X x

A I IPv6 FAN-Backend Traffic (Packets) X

AMI IPv6 Backend Inbound/Outbound Packet

X

Ratio - Not Implemented

AMI IPv6 FAN Sourced Traffic (Packets) x

Communications Link Success x x

Percent Handshake Overhead Traffic x x

Security, Privacy, Unique FAN Source Nodes x x and Safety

Unique FAN Destination Nodes -Not

Implemented x x

Encrypted Command Traffic - UDP 648 (Packets ) j X x

Unencrypted Command Traffic - UDP 648

(Packets) x x

Unencrypted Command Traffic - UDP 645

(Packets) x x

Gateway Advertisement Traffic (Packets) - Not

Implemented x x Trap Traffic (Packets) X x

Percent MLME Security Usage X x

MLME Version X x

AMI Gateway Inbound Traffic (Packets) - Not

X

Implemented

DNP3 Traffic in the Clear (Packets) - Not

X

Implemented x

FAN Routing Network Registration Requests (Packets) X x

Network Registration Request/Response Ratio -

X

Not Implemented x

Average FAN Gateway Path Cost X x

AMI Average Hop Count (+1) X

Routing Traffic (Bytes) X x

Node Discovery and Maintenance Traffic

X

(Packets) x

Average IPv6 Hop Limit X x

DA SCADA DA SCADA Traffic (Packets) x

DA Management and DNS Traffic (Packets) x

DA IPv4 Inbound/Outbound Packet Ratio x

Average IPv4 Hop Limit X x

Smart Grid Service Firmware Update Traffic (Packets) X x

AMI Meter Read Traffic -Not Implemented X

HAN Traffic (Packets) -Not Implemented X

Direct Load Control Traffic (Packets) Volume -

X

Not Implemented x

Gas Meter Read Traffic - Not Implemented X

Network Service DNS Update Traffic (Packets) X x

DNS Update Request /Response Packet Ratio X x

DNS Transaction Latency Range (Seconds) X x

Hourly DNS Transaction Latency Range

X X

(Seconds)

Network Unencrypted Command Latency Range - UDP X X Performance 645 (Seconds)

Command Latency Range - UDP 648 (Seconds) X

Hourly Command Latency Range - UDP 648

X

(Seconds)

I.

[00105] In an embodiment of the present invention, the FAN Traffic Indicator Group indicators measure different attributes of FAN traffic composition and volume in the AMI and DA networks.

[00106] In an aspect of the present invention, a FAN Traffic Composition - Protocol

Indicator calculates the percentage of packets for each traffic type observed across both AMI and DA networks during the analysis window. The traffic profile is a sort of fingerprint for the area monitored by a probe or set of probes. Traffic type can be aligned according to protocol or service application. When calculated based on service application, for example, meter reading, DA SCADA and Home Area Network Traffic, the FAN Traffic Composition Indicator - Service shows which applications generate the most traffic. FIG. [[14]]28 is an example indicator chart generated in a graphical user interface (GUI) by the program code for viewing by a user, based on protocol for FAN Traffic Composition - Protocol.

[00107] In an embodiment of the present invention, The FAN Traffic Composition - Protocol (No Overhead) Indicator calculates the percentage of packets for each traffic type excluding communications link handshake overhead packets observed in the AMI and DA networks during the analysis window. By excluding communications link handshake overhead packets, which tend to dominate FAN traffic, the FAN Traffic Composition - Protocol (No Overhead) Indicator zooms in on just the data-carrying traffic that effectively makes up the collective 20-25% wedge of application, routing, and maintenance traffic in the FAN Traffic Composition - Protocol Indicator. Similar to the FAN Traffic Composition - Protocol Indicator, the FAN Traffic Composition - Protocol (No Overhead) is a sort of fingerprint for the area monitored by a probe or set of probes. Traffic type can be aligned according to protocol or service application. When calculated based on service application, for example, meter reading, DA SCADA and Home Area Network Traffic, the FAN Traffic Composition Indicator - Service (No Overhead) shows which applications generate the most traffic excluding overhead. An example indicator chart for FAN Traffic Composition - Protocol (No Overhead) is shown below.

[00108] In some embodiments of the present invention, the Total FAN Traffic (Packets) Indicator calculates the total number of FAN packets observed in the AMI and DA networks during the analysis window. In an aspect of certain embodiments, disregarding ambient mesh maintenance traffic, FAN packet volume is correlated to Smart Grid applications, such as meter reading and SCADA monitoring. FIG. [[16]]29 is an example indicator chart for Total FAN Traffic (Packets) is shown below. The characteristic peaks of meter reading jobs occurring at 4 hour intervals or six times per day are observed. SCADA traffic, which is more continuous in nature, tends to fill the "gaps" between meter read jobs.

[00109] In an embodiment of the present invention, the AMI IPv6 Backend Traffic (Packets) Indicator calculates the total number of FAN packets containing embedded IPv6 traffic whose source or destination is a backend system serving the AMI network observed during the analysis window. The AMI IPv6 FAN-Backend Traffic (Packets) Indicator excludes DA SCADA traffic, as well as other packets, such as routing maintenance and overhead packets generated by AMI nodes that do not contain embedded IPv6 traffic. The AMI IPv6 FAN-Backend Traffic (Packets) Indicator is highly correlated to AMI operations, such as meter reading, and is typically an indicator of AMI traffic flowing between field nodes and backend systems. Other traffic that traverses the backend includes DNS, Firmware Updates HAN Management, and Security. A single packet originating from or destined to the backend may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[17]]30 is an example indicator chart for AMI IPv6 FAN-Backend Traffic (Packets). The characteristic peaks of meter reading jobs occurring at 4 hour intervals or six times per day are observed.

[00110] In embodiments of the present invention, the AMI IPv6 Backend

Inbound/Outbound Packet Ratio Indicator tracks the ratio of inbound IPv6 FAN packets to outbound IPv6 FAN packets to and from the AMI backend during the analysis window. The AMI IPv6 Backend Inbound/Outbound Packet Ratio Indicator primarily uses embedded IPv6 traffic associated with AMI operations, such as meter reading and HAN communications, as well as network services traffic, such as DNS, and security maintenance. A single packet originating from or destined to the AMI backend may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. However, if both inbound and outbound traffic are observed equally on multiple hops, the AMI IPv6 Backend Inbound/Outbound Packet Ratio should not be affected. An AMI IPv6 Backend Inbound/Outbound Packet Ratio significantly larger than 1 indicates field node difficulty to reach backend systems or possibly an effort by malicious field nodes to penetrate backend systems from the wireless mesh. FIG. [[18]]31 is an example indicator chart for the AMI IPv6 Backend Inbound/Outbound Packet Ratio.

[00111] In embodiments of the present invention, the AMI IPv6 FAN Sourced Traffic (Packets) Indicator calculates the number of FAN packets containing embedded IPv6 traffic whose source is a node observed in the AMI network during the analysis window. The AMI IPv6 FAN Sourced Traffic (Packets) Indicator excludes DA SCADA traffic, as well as other packets, such as routing maintenance and overhead packets generated by AMI nodes that do not contain embedded IPv6 traffic. The AMI IPv6 FAN Sourced Traffic (Packets) Indicator is highly correlated to AMI operations, such as meter reading. Other traffic that uses an IPv6 FAN source includes DNS, Firmware Updates, HAN Management, and Security. A single packet originating from an IPv6 FAN source may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[19]]32 is an example indicator chart for AMI IPv6 FAN Sourced Traffic (Packets). In the example below, the characteristic peaks of meter reading jobs occurring at 4 hour intervals or six times per day can be observed.

[00112] In embodiments of the present invention, the Communications Link Success Indicator calculates the ratio of successful communication link exchanges [i.e., those with a data packet acknowledgment) to communication link attempts observed in the AMI and DA networks during the analysis window. A low communication link success rate indicates that field nodes are having trouble communicating with one another, when the communication distance is 1 hop. FIG. [[20]]33 is an example indicator chart for Communications Link Success.

[00113] In embodiments of the present invention, the Percent Handshake Overhead Traffic Indicator calculates the percentage of handshake overhead packets to all FAN packets observed in the AMI and DA networks during the analysis window. It is a measure of overhead traffic in the network. In certain AMI and DA networks, the handshake overhead percentage for a unicast communications link transaction is typically 75% for a successful single data packet communications link, i.e., one data packet for three overhead packets. Some packets are broadcast and do not create a communications link. A higher handshake overhead percentage indicates communication link failures are occurring within the mesh. FIG. [[21]]34 is an example indicator chart for Percent Handshake Overhead.

[00114] In an embodiment of the present invention, program code executed certain indicators to measure traffic attributes related to FAN security, privacy and safety in the AMI and DA networks. Non-limiting examples of these indicators are discussed in the paragraphs that follow.

[00115] In an embodiment of the present invention, The Unique Source Nodes Indicator tracks the number of unique physical source MAC addresses observed in the AMI and DA networks during the analysis window. Meters may communicate at a fairly constant rate resulting in a unique source node count that remains relatively steady over the analysis window. A decrease in this indicator may imply that a number of nodes have stopped communicating, while an increase may indicate more nodes are communicating than usual. An unusual event, such as a power outage, a system reboot (even staggered) or distributed denial of service attack will cause the Unique Source Nodes Indicator to spike, as many nodes suddenly start communicating over a very short period of time. The effect of scheduled jobs, such as meter reads, is not pronounced in this indicator. FIG. [[22]]35 is an example indicator chart for Unique Source Nodes. [00116] In an embodiment of the present invention the Unique Destination Nodes Indicator tracks the number of unique physical destination MAC addresses observed in the AMI and DA networks during the analysis window. Similar to the Unique Source Nodes Indicator, the Unique Destination Nodes Indicator may remain relatively steady over the analysis window. A sudden increase in the number of unique destination addresses could result from a power outage, a system reboot, or malicious activity to scan an address range. FIG. [[23]]36 is an example indicator chart for Unique FAN Destination Nodes.

[00117] In an embodiment of the present invention, the Encrypted Command Traffic - UDP 648 (Packets) Indicator tracks the number of encrypted IPv6 FAN packets using UDP port 648 observed in the AMI or DA networks during the analysis window. This indicator primarily measures non-null role Management commands to the secure port. In an enhanced security network, the Encrypted Command Traffic - UDP 648 (Packets) Indicator is highly correlated to AMI operations, such as meter reading. A single packet with an encrypted Management command may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[24]]37 is an example indicator chart for Encrypted Command Traffic - UDP 648 (Packets). The characteristic peaks of meter reading jobs occurring at 4 hour intervals or six times per day are observed.

[00118] In an embodiment of the present invention, the Unencrypted Command Traffic - UDP 648 (Packets) Indicator tracks the number of unencrypted IPv6 FAN packets using UDP Port 648 observed in the AMI or DA networks during the analysis window. This indicator primarily measures the number of "null role" Management commands sent to the secure port. In an enhanced security network, "null role" commands are used to read information from field nodes. A single packet with an unencrypted Management command may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[25]]38 is an example indicator chart for Unencrypted Command Traffic - UDP 648 (Packets).

[00119] In an embodiment of the present invention, The Unencrypted Command Traffic - UDP 645 (Packets) Indicator tracks the number of unencrypted IPv6 FAN packets using UDP Port 645 observed in the AMI or DA networks during the analysis window. This indicator primarily measures the number of Management commands sent to the insecure port. In a basic security network, the insecure Command Port should rarely be used and activity on this port should be investigated. A single packet with an unencrypted Management command may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[26]]39 is an example indicator chart for Unencrypted Command Traffic - UDP 645 (Packets).

[00120] In an embodiment of the present invention, the Gateway Advertisement Traffic (Packets) Indicator tracks the number of packets associated with the advertisement of AP and DA master gateways observed in the AMI and DA networks during the analysis window. AP and DA master gateway advertisements may be broadcast or directed. Direct gateway

advertisements are sent as unicast traffic to a specific field node. This indicator may reveal the presence of a rogue node attempting to redirect or black hole the FAN traffic. FIG. [[27]]39 is an example indicator chart for Gateway Advertisement Traffic (Packets).

[00121] In an embodiment of the present invention, the Trap Traffic (Packets) Indicator tracks the number of IPv6 packets using UDP port (647) observed in the AMI or DA networks during the analysis window. This indicator primarily measures asynchronous traps generated by field devices due to a variety of security, revenue assurance, and safety conditions. Traps are sent to the backend trap server on UDP port 647. Traps may be acknowledged or

unacknowledged by the trap server. Trap packets and any acknowledgments are collectively reported by this indicator. A Trap packet may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN. FIG. [[28]]41 is an example indicator chart for Trap Traffic (Packets).

[00122] In an embodiment of the present invention, the Percent MLME Security Usage Indicator tracks the percentage of packets that contain a Media Layer Management Entity (MLME) Security Hash TLV observed in the AMI and DA networks during the analysis window. This indicator primarily measures the use of packet security integrity controls via the MLME layer. FIG. [[29]]42 is an example indicator chart for Percent MLME Security Usage is shown below.

[00123] In an embodiment of the present invention, the MLME Version tracks the version of Media Layer Management Entity (MLME) protocol used in FAN communications observed in the AMI and DA networks during the analysis window. This indicator primarily monitors the version number of the software layer associated with security controls. The indicator should be flat if all field nodes in the system are using the same protocol version. FIG. [[30]]43 is an example indicator chart for MLME Version.

[00124] In an embodiment of the present invention, the AMI Gateway Inbound Traffic (Packets) Indicator tracks the number of FAN packets observed during the analysis window whose physical layer destination is the MAC address of a field network gateway (i.e., an AP) in the AMI network. The AMI Gateway Inbound Traffic (Packets) Indicator is responsive to all FAN packets destined to a gateway, and not just embedded IPv6 traffic destined for backend management systems. Because it uses the physical layer MAC address, this indicator is not affected by packets that are relayed over multiple hops. The AMI Gateway Inbound Traffic (Packets) Indicator can be applied to all gateways or a selected subset. It is recommended to apply it to gateways located nearby probes because probe RF coverage will affect the amount of gateway link traffic intercepted. A significant increase in AMI Gateway Inbound Traffic potentially indicates efforts by malicious actors to scan gateways or penetrate backend systems from the wireless mesh. FIG. [[31]]44 is an example indicator chart for AMI Gateway Inbound Traffic (Packets) is shown below.

[00125] In an embodiment of the present invention, the DNP3 Traffic in the Clear (Packets) Indicator tracks the number of FAN packets containing embedded DNP3 traffic (using TCP source or destination port equal to 20000) transported in the clear in the AMI and DA networks during the analysis window. Ordinarily, DNP3 traffic in our some DA networks is transported through encrypted tunnels. However, a security failure or misconfiguration could result in DNP3 traffic being sent without any protection. No DNP3 traffic is carried by any portion of select AMI network. However, the system architecture permits sharing of certain resources, such as backend gateways. To detect unexpected traffic cross-over, this indicator also monitors for the presence of DNP3 traffic by AMI nodes. Under normal conditions, the DNP3 Traffic in the Clear (Packets) Indicator should show no activity. FIG. [[32]]45 is an example indicator chart for DNP3 Traffic in the Clear (Packets).

[00126] In an embodiment of the present invention, indicators in a FAN Routing Indicator Group measure traffic attributes related to FAN routing, route maintenance, and node discovery in the AMI and DA networks. Non-limiting examples of these types of indicators are discussed in the paragraphs that follow.

[00127] In an embodiment of the present invention, the Network Registration Requests (Packets) Indicator tracks the number of packets that contain a Network Registration Request observed in the AMI and DA networks during the analysis window. Network Registration Requests are sent by Smart Meters and remote DA devices to APs and master DA devices, respectively to associate with an AP or master DA subnet and acquire an IPv6 address, if necessary. Field nodes periodically perform network registration. A large burst of Network Registration Requests indicate that that the mesh has been disturbed and field nodes are trying to reroute. An AP or master DA device failure will also generate a burst of Network Registration Request activity. FIG. [[32]]45 is an example indicator chart for Network Registration Requests (Packets).

[00128] In an embodiment of the present invention, the Network Registration

Request/Response Ratio Indicator tracks the ratio Network Registration Request packets to Network Registration Response packets observed in the AMI and DA networks during the analysis window. Network Registration Requests are sent by Smart Meters and remote DA devices to a field network gateway (an AP or master DA device, respectively) to associate with an AP or master DA subnet and acquire an IPv6 address, if necessary. A Network Registration Request or Response may be counted multiple times if intercepted by a probe on multiple hops in the FAN. However, if we assume both Network Registration Requests and Responses are observed equally on multiple hops, the Network Registration Request/Response Ratio should not be affected. The Network Registration Request/Response Ratio is therefore expected to be close to 1 under normal conditions. A field network gateway failure will generate a burst of Network Registration Request activity and cause this indicator to rise significantly. The Network Registration Request/Response Ratio Indicator may be implemented with full band probes to avoid any effect from channel sampling. FIG. [[33]]46 below is an example indicator chart for the Network Registration/Response Ratio.

[00129] In an embodiment of the present invention, the Average FAN Gateway Path Cost tracks the average path cost to an AP or master DA backend gateway reported in a route advertisement packet by nodes observed in the AMI and DA networks during the analysis window. In a stable mesh FAN, the AP or master DA gateway path cost should remain relatively stable. Significant fluctuations indicate mesh instability or malicious activity such as a routing attack. Node failures will also result in increases in Average FAN Gateway Path Cost. FIG.

[[34]]47 is an example indicator chart for Average FAN Gateway Path Cost is shown below.

[00130] In an embodiment of the present invention, the AMI Average Hop Count (+1) tracks the average number of hops for an AP to send a packet to a field node observed in the AMI network during the analysis window. This indicator tracks the hop count plus one since it uses the address count in source routed packets, which has n+1 addresses for n hops. Smart Grid AMI mesh networks are typically designed with average hop counts between 4 and 8. In a stable mesh FAN, the average hop count should remain relatively stable. An increase in average hop count may indicate an AP failure or the need to re-engineer AP or Relay locations. FIG. [[35]]48 is an example indicator chart for AMI Average Hop Count (+1).

[00131] In an embodiment of the present invention, the Routing Traffic (Bytes) Indicator measures the number of bytes associated with routing protocol packets observed in the AMI and DA networks during the analysis window. Routing packets include broadcast and directed advertisements for APs and DA master gateways, network registration requests and network registration responses. FIG. [[36]]49 is an example indicator chart for Routing Traffic (Bytes) is shown below.

[00132] In an embodiment of the present invention, the Node Discovery and

Maintenance Traffic Indicator tracks the number of packets associated with node discovery and mesh maintenance observed in the AMI and DA networks during the analysis window. Node discovery packets are used by field nodes to announce their presence in the network and discover neighbors. Mesh maintenance packets are used to maintain synchronization information in frequency hopping networks and ensure node queues are fresh. Node Discovery and Maintenance traffic is relatively constant in a stable FAN. A rise in Node Discovery requests can occur if many nodes are rebooted or one or more nodes are maliciously announcing themselves and attempting to identify neighbor nodes on a frequent basis. FIG. [[37]]50 is an example indicator chart for Node Discovery and Maintenance (Packets).

[00133] In an embodiment of the present invention, the Average IPv6 Hop Limit Indicator calculates the average hop limit observed in the header of embedded IPv6 FAN packets observed in the AMI and DA networks during the analysis window. The hop limit is the number of network segments on which an IPv6 packet is allowed to travel before being discarded by a router. The Hop Limit is set by the sending host and is used to prevent packets from endlessly circulating on an IPv6 internetwork. When forwarding an IPv6 packet, IPv6 routers are required to decrease the Hop Limit by 1 and discard the IPv6 packet when the Hop Limit is 0. The Average IPv6 Hop Limit is usually quite stable, unless instabilities occur in the IPv6 path between field nodes and backend management systems. A sudden change typically indicates a routing failure, usually in the backend networks. FIG. [[38]]51 is an example indicator chart for Average IPv6 Hop Limit.

[00134] In an embodiment of the present invention a DA SCADA Indicator Group contains indicators that measure traffic attributes related specifically to the DA SCADA FAN.

[00135] In an embodiment of the present invention, the DA SCADA Tunnel Traffic (Packets) Indicator tracks the number of IPsec Encapsulating Security Payload (ESP) and ISAKMP packets associated with encrypted tunnels for DA SCADA traffic during the analysis window. DA SCADA info is carried as embedded IPv4 traffic in FAN packets using IPsec Encapsulating Security Payload (ESP) and ISAKMP. DA SCADA traffic is usually quite regular and consistent. A significant drop in DA SCADA Tunnel Traffic could indicate a sudden network problem or system misconfiguration that is causing DA SCADA traffic to be sent outside encrypted tunnels in the clear. An indicator change could also indicate misbehaving equipment or malicious activity affecting the encrypted tunnels.

[00136] In an embodiment of the present invention, the DA Management and DNS Traffic (Packets) Indicator tracks the number of FAN packets containing embedded IPv4 traffic between field nodes and the DA management system, field node DNS traffic and any IPv6 traffic exchanged with DA field nodes during the analysis window.

[00137] In an embodiment of the present invention, the DA IPv4 Inbound/Outbound Packet Ratio Indicator tracks the ratio of inbound DA IPv4 FAN packets to outbound DA IPv4 FAN packets during the analysis window. DA traffic includes SCADA traffic between energy control systems and field power components and, to a lesser extent, DA management system traffic.

[00138] In an embodiment of the present invention, the Average IPv4 Hop Limit Indicator calculates the average hop limit (Time To Live) observed in the header of embedded IPv4 FAN packets observed in both the AMI and DA networks during the analysis window. The Average IPv4 Hop Limit Indicator is mainly associated with DA SCADA traffic, which is primarily IPv4 between SCADA energy control systems and field power components. The Hop Limit is the number of network segments on which an IPv4 packet is allowed to travel before being discarded by a router. The Hop Limit is set by the sending host and is used to prevent packets from endlessly circulating on an IPv4 internetwork. When forwarding an IPv4 packet, IPv4 routers are required to decrease the Hop Limit by 1 and discard the IPv4 packet when the Hop Limit is 0. The Average IPv4 Hop Limit is usually quite stable, unless instabilities occur in the IPv4 path between field nodes and backend systems. A sudden change typically indicates a routing failure, usually in the backend networks.

[00139] In an embodiment of the present invention, indicators in Smart Grid Service Indicator Group measure traffic attributes related to Smart Grid services, such as meter reading, Home Area Network messages, direct load control, and firmware updates.

[00140] In an embodiment of the present invention, the Firmware Update Traffic (Packets) Indicator tracks the number of FAN packets associated with the transfer of field node firmware observed in the AMI and DA networks during the analysis window. This indicator monitors the seeding of firmware from the backend management systems into select nodes and the peer-to-peer transfer of firmware between field nodes via a request and response process for image blocks. Transfer of firmware may occur using a dedicated UDP port or at lower FAN protocol layers. The Firmware Update Traffic (Packets) Indicator helps track the progress of firmware update in the mesh when new field node firmware is released. It can help select better seed meters to start the update process. From a security perspective, it may indicate unauthorized firmware update activity spreading through the mesh. When no firmware updates are scheduled, the Firmware Update Traffic (Packets) Indicator should show little to no traffic activity. A small degree of activity may be present due to the deployment of new field nodes, such as meters, during normal utility operations.

[00141] In an embodiment of the present invention, the Meter Read Traffic (Packets) Indicator tracks the number of FAN packets associated with meter reading activity observed in the AMI network during the analysis window. It monitors the embedded IPv6 packets whose source or destination is a backend system that reads meters. Since meter read transactions are usually encrypted, content with the packets is not used as criteria for this indicator. In cases where the backend server performing meter reads also supports other functions, additional criteria is necessary to distinguish meter read traffic from other activity, such as HAN traffic. Meter read traffic is very periodic as meter read jobs typically occur 6 times a day on 4 hour intervals. [00142] In an embodiment of the present invention, the HAN Messaging Traffic (Packets) Indicator tracks the number of FAN packets associated with Home Area Network (HAN) communication between backend management systems and meters observed in the AMI network during the analysis window. Specifically, it monitors the embedded IPv6 packets whose source or destination is a backend system that send HAN messages such as price signals and bill forecasts to in-home devices through Smart Meter. Since HAN transactions are usually encrypted, content with the packets is not used as criteria for this indicator. In cases where the backend server performing HAN messaging also supports other functions, additional criteria is necessary to distinguish HAN traffic from other activity, such as meter reading. The pattern of HAN traffic depends heavily upon the services provided by the utility.

[00143] In an embodiment of the present invention, the Direct Load Control Traffic (Packets) Indicator tracks the number of FAN packets associated with Direct Load Control (DLC) communication between backend management systems and field devices, such as air conditioning compressors and hot water heaters observed in the AMI and DA networks during the analysis window. Specifically, it monitors the embedded IPv6 packets whose source or destination is a backend system that sends DLC commands. Since DLC transactions are usually encrypted, content with the packets is not used as criteria for this indicator. In cases where the backend server performing DLC also supports other functions, additional criteria is necessary to distinguish DLC traffic from other activity, such as HAN messaging. DLC traffic may vary substantially on a daily basis.

[00144] In an embodiment of the present invention, the Gas and Water Meter Read Traffic (Packets) Indicator tracks the number of FAN packets associated with gas and water meter reading activity observed in the AMI network during the analysis window. The operation of gas and water meter reading is system dependent. In some AMI networks, gas and water Integrated Measurement Units (IMU) autonomously and periodically wake up and transmit register information to constantly powered devices, such as Smart Meters or Access Points. This indicator tracks packets associated with the transfer of register data from IMUs to constantly powered devices. Electric meters typically pass IMU readings during electricity usage reads. In some embodiments of the present invention, those packets are not counted by the Gas and Water Meter Read Traffic (Packets) Indicator.

[00145] In an embodiment of the present invention, indicators in a Network Service Indicator Group measure traffic attributes related to network services, such as Domain Name Service (DNS) and Network Time, used by field nodes in the AMI and DA networks.

[00146] In an embodiment of the present invention, the DNS Update Traffic (Packets) Indicator tracks the number of FAN packets containing embedded IPv4 or IPv6 DNS traffic with the Dynamic Update Opcode (5) observed in the AMI and DA networks during the analysis window. DNS Update traffic includes both packets to update DNS records (known as queries) and responses from the DNS server (responses). DNS Update traffic is normally predictable and relatively flat. It is a strong indicator of network health. Sudden spikes in DNS traffic indicate reorganization of nodes in the mesh, which can be the result of node failures, malicious traffic, and sudden changes in the RF environment. A DNS packet may be counted multiple times if the packet is intercepted by a probe on multiple hops in the FAN.

[00147] In an embodiment of the present invention, the DNS Update Request/Response Packet Ratio Indicator tracks the ratio of IPv4/IPv6 DNS Update Request packets to DNS Response Packets observed in the AMI and DA networks during the analysis window.

Specifically, the DNS Update Request/Response Packet Ratio Indicator tracks the ratio of packets to update DNS records (known as queries) to responses from the DNS server

(responses), both with Dynamic Update Opcode (5). The DNS Update Request/Response Packet Ratio is normally flat, but greater than 1. In one example, a ratio greater than 1 indicates that DNS update attempts from field nodes are generally successful reaching the DNS server on the first attempt. This may occur because 1) Packet collisions in the frequency hopping space, 2) Radio conditions that cause packet errors, 3) Next hop routing that is out of date, and 4) node failure. Sudden spikes in the DNS Update Request/Response Packet Ratio typically indicate a gateway or backhaul connectivity failure, which may be temporary in nature. The DNS Update Request/Response Packet Ratio Indicator is also helpful in diagnosing unidirectional network failures, which have occurred with commercial backhaul services.

[00148] In an embodiment of the present invention, the DNS Transaction Latency Range (Seconds) Indicator measures the difference in intercept timestamp between a pair of DNS Response and DNS Request (query) packets with the same DNS transaction ID for IPv4/IPv6 DNS transactions observed in the AMI and DA networks during a short (10 minute) analysis window. The DNS Transaction Latency Range (Seconds) Indicator is not limited to DNS update traffic with Dynamic Update Opcode (5), but includes all DNS transactions supported by the IETF RFC. However, DNS records updates are the primary use of DNS services in AMI and DA FANs.

[00149] In an embodiment of the present invention, the Hourly DNS Transaction Latency Range (Seconds) Indicator measures the difference in intercept timestamp between a pair of DNS Response and DNS Request (query) packets with the same DNS transaction ID for IPv4/IPv6 DNS transactions observed in the AMI and DA networks during a long (1 hour) analysis window. It is similar to the DNS Transaction Latency Range (Seconds) indicator, but with a longer analysis window. The Hourly DNS Transaction Latency Range (Seconds) Indicator is not limited to DNS update traffic with Dynamic Update Opcode (5), but includes all DNS transactions supported by the IETF RFC.

[00150] In an embodiment of the present invention, indicators in a FAN Performance Indicator Group measure traffic attributes related to field network and system performance, such as meter reading and management command transaction latency in the AMI and DA networks.

[00151] In an embodiment of the present invention, the Unencrypted Command Latency Range - UDP 645 (Seconds) Indicator measures the difference in intercept timestamp between a pair of unencrypted command packets with the same Sequence Number on UDP Port 645 of a field node for Management transactions observed in the AMI and DA networks during the analysis window. This indicator primarily measures the latency of a field node to respond to a Management command on the insecure port. The Unencrypted Command Latency Range - UDP 645 (Seconds) Indicator chart is a candlestick display showing the range of latencies and average latency (a small dot on each bar) for Management commands on UDP Port 645.

[00152] In an embodiment of the present invention, the Command Latency Range - UDP 648 (Seconds) Indicator measures the difference in intercept timestamp between a pair of command packets with the same Sequence Number on UDP Port 648 of a field node for Management transactions observed in the AMI and DA networks during a short (10 minute) analysis window. This indicator primarily measures the latency of a field node to respond to a Management command on the secure port. It may include both encrypted commands and unencrypted commands (null role)

[00153] In an embodiment of the present invention, the Hourly Command Latency Range - UDP 648 (Seconds) Indicator measures the difference in intercept timestamp between a pair of command packets with the same Sequence Number on UDP Port 648 of a field node for Management transactions observed in the AMI and DA networks during a long (1 hour) analysis window. This indicator primarily measures the latency of a field node to respond to a

Management command on the secure port. It includes both encrypted commands and unencrypted commands (null role), but generally will be dominated by encrypted commands. It is similar to the Command Latency Range - UDP 648 (Seconds) indicator, but with a longer analysis window.

[00154] Stream and indicator processing can be intensive depending on the volume of traffic, the complexity of the protocols in the stream, and the complexity of the indicator set. To enable parallel processing, indicators can be divided into groups, where each group is serviced by a separate processor that can run on a different processor. In embodiments of the present invention, each group process may have its own copy of the output stream. Returning to FIG. [[1A]]2, the multiples streams pictured may represent the separate copies of the output stream. The indicator processing software can also be a multi-threaded application where each indicator is spawned as a separate process. To further improve performance and prevent the indicators from falling behind real-time, custom dissectors that only expose fields used by a particular indicator group could be used to create a simplified output stream for each indicator group at the expense of more process management.

[00155] As aforementioned, computer resources as utilized in the technical

environments described. To this end, FIG. [[2]]4 illustrates a block diagram of a resource 1300 in computer system 110 and/or terminal 120a-120b in FIG. 1, or a resource in second network 160, backend management system 140, or traffic profiler 170, in FIGs. [[1A-1AA]] 2^3, which is part of the technical architecture of certain embodiments of the technique. The resource 1300 may include a circuitry 370 that may in certain embodiments include a microprocessor 354. The computer system 1300 may also include a memory 355 (e.g., a volatile memory device), and storage 181. The storage 181 may include a non-volatile memory device (e.g., EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, firmware, programmable logic, etc.), magnetic disk drive, optical disk drive, tape drive, etc. The storage 355 may comprise an internal storage device, an attached storage device and/or a network accessible storage device. The system 1300 may include a program logic 330 including code 333 that may be loaded into the memory 355 and executed by the microprocessor 356 or circuitry 370.

[00156] In certain embodiments, the program logic 330 including code 333 may be stored in the storage 181, or memory 355. In certain other embodiments, the program logic 333 may be implemented in the circuitry 370. Therefore, while FIG. [[2]]4_shows the program logic 333 separately from the other elements, the program logic 333 may be implemented in the memory 355 and/or the circuitry 370.

[00157] Using the processing resources of a resource 1300 to execute software, computer-readable code or instructions, does not limit where this code is can be stored.

[00158] Referring to FIG. [[3]]5, in one example, a computer program product 300 includes, for instance, one or more non-transitory computer readable storage media 302 to store computer readable program code means or logic 304 thereon to provide and facilitate one or more aspects of the technique. [00159] As will be appreciated by one skilled in the art, aspects of the technique may be embodied as a system, method or computer program product. Accordingly, aspects of the technique may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit," "module" or "system." Furthermore, aspects of the technique may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

[00160] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus or device.

[00161] A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non- exhaustive list) of the computer readable storage medium include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. [00162] Program code embodied on a computer readable medium may be transmitted using an appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[00163] Computer program code for carrying out operations for aspects of the technique may be written in any combination of one or more programming languages, including an object oriented programming language, such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language, assembler or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[00164] Aspects of the technique are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[00165] These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

[00166] The computer program instructions, also referred to as computer program code, may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[00167] The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the technique. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[00168] In addition to the above, one or more aspects of the technique may be provided, offered, deployed, managed, serviced, etc. by a service provider who offers management of customer environments. For instance, the service provider can create, maintain, support, etc. computer code and/or a computer infrastructure that performs one or more aspects of the technique for one or more customers. In return, the service provider may receive payment from the customer under a subscription and/or fee agreement, as examples. Additionally or alternatively, the service provider may receive payment from the sale of advertising content to one or more third parties.

[00169] In one aspect of the technique, an application may be deployed for performing one or more aspects of the technique. As one example, the deploying of an application comprises providing computer infrastructure operable to perform one or more aspects of the technique.

[00170] As a further aspect of the technique, a computing infrastructure may be deployed comprising integrating computer readable code into a computing system, in which the code in combination with the computing system is capable of performing one or more aspects of the technique. As a further aspect of the technique, the system can operate in a peer to peer mode where certain system resources, including but not limited to, one or more databases, is/are shared, but the program code executable by one or more processors is loaded locally on each computer (workstation).

[00171] As yet a further aspect of the technique, a process for integrating computing infrastructure comprising integrating computer readable code into a computer system may be provided. The computer system comprises a computer readable medium, in which the computer medium comprises one or more aspects of the technique. The code in combination with the computer system is capable of performing one or more aspects of the technique.

[00172] Further, other types of computing environments can benefit from one or more aspects of the technique. As an example, an environment may include an emulator [e.g., software or other emulation mechanisms), in which a particular architecture (including, for instance, instruction execution, architected functions, such as address translation, and architected registers) or a subset thereof is emulated (e.g., on a native computer system having a processor and memory). In such an environment, one or more emulation functions of the emulator can implement one or more aspects of the technique, even though a computer executing the emulator may have a different architecture than the capabilities being emulated. As one example, in emulation mode, the specific instruction or operation being emulated is decoded, and an appropriate emulation function is built to implement the individual instruction or operation.

[00173] In an emulation environment, a host computer includes, for instance, a memory to store instructions and data; an instruction fetch unit to fetch instructions from memory and to optionally, provide local buffering for the fetched instruction; an instruction decode unit to receive the fetched instructions and to determine the type of instructions that have been fetched; and an instruction execution unit to execute the instructions. Execution may include loading data into a register from memory; storing data back to memory from a register; or performing some type of arithmetic or logical operation, as determined by the decode unit. In one example, each unit is implemented in software. For instance, the operations being performed by the units are implemented as one or more subroutines within emulator software.

[00174] Further, a data processing system suitable for storing and/or executing program code is usable that includes at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements include, for instance, local memory employed during actual execution of the program code, bulk storage, and cache memory which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.

[00175] Input/Output or I/O devices (including, but not limited to, keyboards, displays, pointing devices, DASD, tape, CDs, DVDs, thumb drives and other memory media, etc.) can be coupled to the system either directly or through intervening I/O controllers. Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the available types of network adapters.

[00176] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and/or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or groups thereof.

[00177] The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the descriptions below, if any, are intended to include any structure, material, or act for performing the function in combination with other elements as specifically noted. The description of the technique has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.