Patent ID: 8224952
Filing Date: 2012-07-17
Classification: H04L

Abstract:
1. A method of operating a communication network, comprising: determining whether a network element can be trusted, wherein determining whether a network element can be trusted comprises: generating a first hash value based on data associated with the network element at a first time; generating a second hash value based on the data associated with the network element at a second time different than the first time; and comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in a configuration of the network element between the first time and the second time; and monitoring traffic associated with the network element based on whether the network element can be trusted; wherein monitoring traffic comprises: selecting traffic for monitoring using rules that are based on network element trust information; selecting at least some of the traffic that was monitored for examination based on a degree of trust for the network element; examining the at least some of the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine if the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the at least some of the traffic that was monitored and was selected using rules contains unexpected information to a human expert interface based on the degree of trust for the network element; wherein the level of examination of the at least some of the traffic that was monitored is based on the degree of trust for the network element.