Patent Publication Number: US-7216260-B2

Title: Method, system and program product for dynamically detecting errant data sequences and performing corresponding actions

Description:
BACKGROUND OF THE INVENTION 
   1. Field of the Invention 
   The present invention generally relates to a method, system and program product for dynamically detecting errant data sequences, under optionally enumerated conditions and performing corresponding actions. Specifically, the present invention utilizes a definable data structure to detect and handle an errant data sequence received over a network. 
   2. Background Art 
   As the implementation of computer networks in business becomes more pervasive, the frequency in which accidental or malicious attacks on such networks increases. For example, a printer attached to a server on the network may experience an error that causes a certain data sequence to be generated. Unfortunately, in generating the data sequence, the printer might get caught in a loop that causes the same data sequence to be generated and sent to the server thousands of times. When this occurs, an application residing on the sever will receive each data sequence in rapid succession. This causes the data sequences to pile up in the server&#39;s memory, which may ultimately crash the server. Similar problems are experienced when a network is subject to a malicious denial of service attack. Specifically, in an attempt to deprive other users of the capability to connect to the server, a hacker could establish multiple connections with a server in the network from a single client. Such connections would drain the capacity of the server and thus, cause service to be denied to legitimate users. 
   Heretofore, attempts have been made to circumvent these problems by hard coding a solution to the errant data (e.g., problematic, recurring, etc.) sequences into the application itself. For example, with respect to the printer scenario discussed above, the application would be hard coded to search for the particular errant data sequence that causes the problem, and take appropriate action. However, various problems arise when hard coding an application in this manner. Specifically, with each solution that is implemented, a service release involving modification of the code in the application must be made to all customers. This is not only costly, but also causes the customer to experience downtime while their application is updated or serviced. Moreover, since new errant data sequences are constantly being discovered, hard coding the solutions into the application can become unduly burdensome to both the application&#39;s creator and the customers. 
   In view of the foregoing, there exists a need for a method, system and program product for dynamically detecting errant data sequences such that hard coding a solution into an underlying application is not required. Further, a need exists for errant data sequences to be dynamically detected based on a definable data structure. Moreover, a need exists for corresponding actions (e.g., corrective, filtering, etc.) to be implemented when an errant data sequence is detected. 
   SUMMARY OF THE INVENTION 
   In general, the present invention provides a method, system and program product for dynamically detecting an errant data sequence (e.g., problematic, recurring, etc.) transmitted over a network and performing a corresponding action. Specifically, a data sequence is received by a server from a client and compared to a definable data structure. The data structure comprises rules that each pertain to a state of communication between the server and a client. Each rule sets forth a predetermined data sequence, an optional condition and an action. If the received data sequence: (1) matches one of the predetermined data sequences in the data structure; (2) was received during the state of communication to which the rule pertains; and (3) meets any enumerated conditions, a corresponding action is performed. 
   According to a first aspect of the present invention, a method for dynamically detecting an errant data sequence and performing a corresponding action is provided. The method comprises the steps of: (1) receiving a data sequence in an application; (2) accessing a definable data structure that contains predetermined data sequences and actions; (3) comparing the received data sequence to the predetermined data sequences in the data structure; and (4) performing a corresponding action, if the received data sequence matches one of the predetermined data sequences. 
   According to a second aspect of the present invention, a method for dynamically detecting an errant data sequence and performing a corresponding action is provided. The method comprises the steps of: (1) providing an application stored on a computer system; (2) receiving a data sequence in the application; (3) comparing the received data sequence to predetermined data sequences identified in a definable data structure; (4) determining whether the received data sequence is relevant to a state of communication during which it was received; (5) determining whether the received data sequence meets an enumerated condition identified in the data structure; and (6) performing a corresponding enumerated action. 
   According to a third aspect of the present invention, a system for dynamically detecting an errant data sequence and performing a corresponding action is provided. The system comprises: (1) a system for receiving a data sequence in an application; (2) a system for accessing a definable data structure that contains predetermined data sequences and actions; (3) a system for comparing the received data sequence to the predetermined data sequences in the data structure; and (4) a system for performing a corresponding action, if the received data sequence matches one of the predetermined data sequences. 
   According to a fourth aspect of the present invention, a program product stored on a recordable medium for dynamically detecting an errant data sequence and performing a corresponding action is provided. When executed, the program product comprises: (1) program code for receiving a data sequence in an application; (2) program code for accessing a definable data structure that contains predetermined data sequences and actions; (3) program code for comparing the received data sequence to the predetermined data sequences in the data structure; and (4) program code for performing a corresponding action, if the received data sequence matches one of the predetermined data sequences. 
   Therefore, the present invention provides a method, system and program product for dynamically detecting an errant data sequence and performing a corresponding action. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
     These and other features of this invention will be more readily understood from the following detailed description of the various aspects of the invention taken in conjunction with the accompanying drawings in which: 
       FIG. 1  depicts a computer system having an application with checkpoints according to the present invention. 
       FIG. 2  depicts a box diagram of one of the checkpoints of  FIG. 1 . 
       FIG. 3  depicts an exemplary table representation of a data structure according to the present invention. 
       FIG. 4  depicts a process flow diagram of the present invention. 
   

   The drawings are merely schematic representations, not intended to portray specific parameters of the invention. The drawings are intended to depict only typical embodiments of the invention, and therefore should not be considered as limiting the scope of the invention. In the drawings, like numbering represents like elements. 
   DETAILED DESCRIPTION OF THE INVENTION 
   As indicated above, the present invention allows an errant data sequence transmitted over a network to be dynamically detected and handled. Specifically, under the present invention, an application on a server is programmed with one or more checkpoints. When a data sequence is received from a client, the checkpoint will perform various operations, based on a definable data structure, to determine whether the received data sequence is errant. If the received data sequence is in fact errant, the appropriate action will be implemented. Such actions can include, among others, corrective actions, filtration, etc. As used herein, the term “errant” is intended to refer to any problematic, troublesome or recurring data sequence. In the content of the present invention, an errant data sequence is one that may cause a computer system (e.g., a server) to malfunction. However, it should be appreciated that, while the present invention is described herein as a solution to errant data sequences, it might also be implemented as a solution that can flag or identify non-errant data sequences. This would be analogous to filtering based on certain phrases or keywords. 
   Referring now to  FIG. 1 , a typical network implementation of the present invention is depicted. As shown, remote system  10 , workstation  30 , optional remote storage  48  and administrator  49  communicate with server  12  via communications links  36 , Communications links  36  are intended to represent any possible method of communicating with server  12 . For example workstation  30  and/or administrator  49  can communicate with server  12  as/with a direct terminal connected to server  12  or remotely in a client-server environment. In the case of the latter, client and server may be connected via the Internet, wide area networks (WAN), local area networks (LAN) or other private networks. The server and client may utilize conventional network connectivity, such as Token Ring, Ethernet, or other conventional communications standards. Moreover, remote system  10  and remote storage  48  are intended to be representative of systems connected to server  12  in a client-server environment via, for example, the Internet. In this case, connectivity could be provided by conventional TCP/IP sockets-based protocol, and remote system  10  would utilize an Internet service provider to establish connectivity to server  12 . It should be understood that the depiction of  FIG. 1  is intended to be exemplary only, and that the present invention could be implemented with many network variations. 
   As shown, server  12  generally comprises memory  14 , central processing unit (CPU)  16 , bus  18 , input/output (I/O) interfaces  20 , external devices/resources  22  and database  24 . Memory  14  may comprise any known type of data storage and/or transmission media, including magnetic media, optical media, random access memory (RAM), read-only memory (ROM), a data cache, a data object, etc. Moreover, memory  14  may reside at a single physical location, comprising one or more types of data storage, or be distributed across a plurality of physical systems in various forms. CPU  16  may likewise comprise a single processing unit, or be distributed across one or more processing units in one or more locations, e.g., on a client and server. 
   I/O interfaces  20  may comprise any system for exchanging information to/from an external source. External devices  22  may comprise any known type of external device, including speakers, a CRT, LED screen, hand-held device, keyboard, mouse, voice recognition system, speech output system, printer, monitor, facsimile, pager, etc. Bus  18  provides a communication link between each of the components in the server  12  and likewise may comprise any known type of transmission link, including electrical, optical, wireless, etc. In addition, although not shown, additional components, such as cache memory, communication systems, system software, etc., may be incorporated into server  12 . 
   Database  24  may provide storage for information necessary to carry out the present invention such as a definable data structure  50 , etc. As such, database  24  may include one or more storage devices, such as a magnetic disk drive or an optical disk drive. In another embodiment, database  24  includes data distributed across, for example, a local area network (LAN), wide area network (WAN) or a storage area network (SAN) (not shown). Database  24  may also be configured in such a way that one of ordinary skill in the art may interpret it to include one or more storage devices. 
   It should be understood that although not shown in  FIG. 1 , remote system  10  and workstation  30  include computer components (e.g., CPU, memory, etc.) similar to server  12 . Such components have not been shown for brevity purposes. 
   Stored in remote system  10  is emulator program  28 , which allows remote system  10  to emulate workstation  30 . That is, emulator program  28  allows a remote system  10  (e.g., a laptop) to adopt the look and feel of an office workstation. This is especially helpful to a user who is out of the office, and has configured workstation  30  to have a particular look and feel (e.g., arrangement of icons, etc.). Without emulator program  28 , communication with server  12  will occur via a web browser. Because the user may be not as familiar with interfacing with server  12  through a browser, the user may be less efficient. One common type of emulator program  28  is known as Telnet. For example, if server  12  is an AS/400 or iSeries server available from International Business Machines, Corp. of Armonk, N.Y., Telnet 5250 emulator program can be used to make any remote system  10  have the look and feel of workstation  30 . 
   It should be understood, that the use of emulator program  28  is not necessary under the present invention. Rather, emulator program  28  has been depicted only to provide one scenario in which the present invention can be implemented. 
   As indicated above, errant data sequences have caused great problems for network servers. For example, if the user is out of the office and using remote system  10  to communicate with server  12 , the user may wish to print a document to printer  26 . Because remote system  10  includes emulator program  28 , printer  26  that is local to remote system  10  (e.g., connected to the laptop in the hotel room), will appear to server  12  as if it is actually connected locally to server  12 . However, if printer  26  experiences an error, a data sequence indicating the error will be generated and communicated to server  12 . Should printer  26  get caught in a loop, the same data sequence could be communicated to application  34  in server  12  thousands of times. Such communications can result in server  12  crashing. Similarly, a hacker using remote system  10  to establish multiple connections to server  12  could cause, for example, a legitimate remote system or workstation  30  to be denied a connection to server  12  because the pool of available connections is completely consumed by the hacker system. In this case, the hacker would communicate the same data sequence multiple times to server  12 . In either of these two scenarios, the data sequence is considered an errant data sequence because it will cause some level of problems for the server  12 . 
   To avoid such problems, application  32  (e.g., an operating system) is preprogrammed with one or more checkpoints  34  to dynamically detect errant data sequences from remote system  10  and/or workstation  30 . Under the present invention, each checkpoint  34  can be thought of as a detection system that includes sub-systems (i.e., program code) for processing an incoming data sequence, based on a definable data structure, to determine if the incoming data sequence is errant. If so, appropriate corresponding action can be taken. It should be understood that checkpoints  34  can be programmed into any location of application  32 . This allows checkpoints  34  to be strategically programmed within application  32 . It should also be understood that although application  32  is typically an operating system, the teachings of the present invention could be used with any application. 
   Referring now to  FIG. 2 , an exemplary checkpoint  34  is shown in greater detail. As depicted, checkpoint  34  includes reception system  40 , comparison system  42 , state system  44  and action system  46 . Reception system  40  will receive an incoming data sequence. Once received, a definable data structure will be accessed from local storage (e.g., database  24 , diskette, etc.) or remote storage  48 . Under the present invention, the data structure is created using program code in a language such as Extensible Markup Language (XML) and comprises rules that each correspond to one or more communication states. The communication states relate to the phases of communication between server  12  and another computer system such as remote system  10  and/or workstation  30 . Such states are generally well known in the art and include: (1) connect phase; (2) negotiation phase; (3) steady-state phase; (4) confirmation phase; and (5) termination phase. Each rule typically includes a predetermined data sequence, a corresponding action, and an optional condition. 
   Referring to  FIG. 3 , an exemplary depiction of data structure  50  in a table form is shown. As indicated above, data structure  50  is definable (e.g., modifiable) and is created using XML or the like. The depiction of data structure  50  as a table is for illustrative purposes only. As depicted, data structure  50  includes rules  52 A–H with each rule corresponding to a communication state  54  and identifying a predetermined data sequence  56 , an enumerated condition  58  (if any) and an action  60 . Under this data structure  50 , a received data sequence is errant if it: (1) matches a predetermined data sequence; (2) is relevant to the communication state during which it was received; and (3) meets any enumerated conditions (i.e., conditions set forth). For example, under “connect phase,” two rules  52 A–B have been identified. If data sequence “0×123456789” is received more than twice from the same source during the “connect phase,” the data sequence is errant and a log to the file should be made. If however, the data sequence was not received more than twice from the same source, or if the data sequence was received during another communication state (e.g., during negotiation phase), the received data sequence would not be identified as errant and no action would be taken. 
   As can be further seen from data structure  50 , it is not necessary to specify any conditions. For example, if data sequence 0×CCFF233E6 in rule  52 E is received at all during the “confirmation phase,” an administrator will be notified. Moreover, data structure  50  can be defined to include an “All Phases”  52 H rule. This allows a particular data sequence to be made applicable to all communication states. That is, it would not be necessary to input the same data sequence under each communication phase. 
   Data structure  50  is particularly advantageous because it is not hard coded into application  32  and is modifiable. Previously, errant data sequences and solutions were hard coded into application  32 . This was not only time-consuming and expense, but it also required updated versions of the application  32  to be circulated to all customers. This problem was compounded by the fact that new errant data sequences are constantly being discovered. Thus, updating application  32  became constant and unduly burdensome. 
   Under the present invention, all information necessary to identify and deal with errant data sequences, are contained in the updatable data structure  50 , As new errant data sequences are discovered, or existing data sequences are modified, an update to data structure  50  is all that is required. To this extent, data structure  50  can be stored locally in database  24  ( FIG. 1 ) or at a remote location  48  to which server  12  can be pointed. If stored locally on server  12 , updates to data structure  50  can be disseminated with far less effort than disseminating updates to the application  32 . Moreover, if data structure  50  is merely pointed to by server  12 , the customer need not even be aware of the update. 
   In a typical embodiment, definable data structure  50  is constructed using XML. Listed below is exemplary code associated therewith: 
                                          &lt;XML&gt;                         &lt;Head&gt;                         &lt;Sender&gt;                         &lt;OrganizationName&gt;IBM&lt;/OrganizationName&gt;           &lt;OrganizationAuthenticationInfo&gt;XXXXX&lt;/           OrganizationAuthenticationInfo&gt;                         &lt;/Sender&gt;                         &lt;/Head&gt;           &lt;Body&gt;                         &lt;TelnetPrinters&gt;                         &lt;Data&gt;                         &lt;HexBytes&gt;12345678901234&lt;/HexBytes&gt;           &lt;State&gt;Steady&lt;/State&gt;           &lt;Action&gt;Disconnect&lt;/Action&gt;           &lt;Action&gt;Filter&lt;Action&gt;           &lt;Action&gt;LogToFile&lt;/Action&gt;           &lt;ConsecutivePacketsToAccept&gt;2&lt;/           ConsecutivePacketsToAccept&gt;                         &lt;Data&gt;           &lt;Data&gt;                         &lt;HexBytes&gt;FF12EE34DD56&lt;/HexBytes&gt;           &lt;State&gt;All&lt;/State&gt;           &lt;Action&gt;Disconnect&lt;/Action&gt;           &lt;Action&gt;NotifyAdministratorr&lt;/Action&gt;           &lt;ConsecutivePacketsToAccept&gt;10&lt;/           ConsecutivePacketsToAccept&gt;                         &lt;/Data&gt;                         &lt;/TelnetPrinters&gt;           &lt;OtherApplication&gt;           . . .           &lt;/OtherApplication&gt;                         &lt;/Body&gt;                         &lt;/XML&gt;                        
As can be seen from the above code, data structure  50  can incorporate any quantity and/or type of applications running on server  12 . That is, data structure  50  is not limited to one type of application. If multiple applications are running on server  12 , and each application has its own errant sequences, data structure  50  can filter incoming data sequences according to application. For example, if a received data sequence is errant for application “A” but not for application “B,” and application “A” did not receive/process the data sequence, there would be no need to implement any type of action.
 
   In any event, once a data sequence is received by reception system comparison system  42  will compare the received data sequences to the predetermined data sequence identified in the data structure  50 . If a match is established, state system  44  will determine whether the received data sequence is relevant to a state of communication. In making this determination, the current state of communication must be identified. This can be done prior to or after comparing the data sequence to the data sequences in data structure  50 . In either event, once the current state of communication is known, it will be determined whether the received data sequence was indicated in data structure  50  as being relevant to this state. As indicated above, a data sequence might be identified as errant only during the negotiation phase. Thus, if the received data sequence was received during the steady-state phase, the received data sequence cannot be errant. However, if it is determined that the received data sequence was received during the relevant/pertinent communication state, then it would be determined if any enumerated conditions have been met. For example, if the corresponding rule indicated that the data sequence is errant if received more than twice consecutively from the same source, and the data sequence was received only once from a single source, it would not be identified as errant. Conversely, if the data sequence was received more than twice from the same source, then action system  46  would perform any corresponding actions. Such actions include, but are not limited to, logging the errant data sequence in a file, notifying an administrator  49 , disconnecting a device (e.g., the printer  26 ), etc. 
   Referring now to  FIG. 4 , a method flow diagram of the present invention is shown in detail. As depicted, a data sequence is received  100  and compared to data structure to identify any matches  102 . If no match exists, the data sequence is not errant and is processed by server  12  as normal  108 . If, however, a match exists, it is then determined whether the received data sequence pertains to a relevant communication state  104 . Specifically, it is determined whether data sequence was received during the communication state that corresponds to the matched predetermined data sequence. If not, the data sequence is processed as normal  108 . Conversely, if the received data sequence does pertain to the relevant communication state, then it must be determined whether any enumerated conditions have been met  106 . If not, then the data sequence is processed as normal  108 . However, if the data sequence also met the enumerated conditions, the defined corresponding action(s) would be taken  110 . As shown, such actions could include, among other things, notifying an administrator  112 A, disconnecting a device  112 B, filtering a remote application  112 C, logging the file  112 D, etc. Accordingly, because data sequences can be processed as they are received based on a definable data structure, the present invention provides the capability to dynamically detect and handle errant data sequences. 
   It should be understood that, as indicated above, above-referenced steps could be performed in a varying order. For example, a current state of communication (i.e., for determining state of communication relevance) could be identified prior to or after comparing the received data sequence to data structure  50  to identify any matches. 
   It is understood that the present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer/server system(s)—or other apparatus adapted for carrying out the methods described herein—is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when loaded and executed, controls server  12  such that it carries out the methods described herein. Alternatively, a specific use computer, containing specialized hardware for carrying out one or more of the functional tasks of the invention could be utilized. The present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods. Computer program, software program, program, or software, in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: (a) conversion to another language, code or notation; and/or (b) reproduction in a different material form. 
   The foregoing description of the preferred embodiments of this invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously, many modifications and variations are possible. Such modifications and variations that may be apparent to a person skilled in the art are intended to be included within the scope of this invention as defined by the accompanying claims.