Optimizations for application dependency mapping

Patent metadata

Field	Value
Publication number	US-10230597-B2
Application number	US-201615174032-A
Country	US
Kind code	B2
Filing date	Jun 6, 2016
Priority date	Jun 5, 2015
Publication date	Mar 12, 2019
Grant date	Mar 12, 2019

Abstract

Application dependency mapping can be automated in a network. The network can capture traffic data for flows passing through the network using a sensor network that provides multiple perspectives for the traffic. The network can analyze the traffic data to identify endpoints of the network. The network can also identify particular network configurations from the traffic data, such as a load balancing schema or a subnetting schema. The network can partition the endpoints based on the network configuration(s) and perform similarity measurements of endpoints in each partition to determine clusters of each partition. The clusters can make up nodes of an application dependency map, and relationships between and among the clusters can make up edges of the application dependency map.

First claim

The invention claimed is:

1. A method comprising:
capturing network traffic data for a plurality of flows in a network using a plurality of sensors that includes at least a first sensor on a first physical server of the network, a second sensor on a virtual partition of the network, and a third sensor on a networking device of the network;
determining a plurality of endpoints of the network using the network traffic data;
partitioning the plurality of endpoints into a plurality of partitions based on one or more network configurations, the partitions including a first partition of endpoints for which there has been a user request for application dependency maps, and a second partition of endpoints that communicate with endpoints in the first partition but for which there has not been a user request for application dependency maps;
determining a respective plurality of clusters for each of the plurality of partitions using the network traffic data; and
generating an application dependency map using the respective plurality of clusters.

2. The method of claim 1 , wherein the one more network configurations include a load balancing schema, and the method further comprises:
identifying one or more endpoints forming a server farm corresponding to the load balancing schema,
wherein a first partition of the plurality of partitions includes the one or more endpoints.

3. The method of claim 2 , further comprising:
analyzing the network traffic data to identify the load balancing schema.

4. The method of claim 3 , wherein the network traffic data includes one or more packet attributes of first flows of a first endpoint of the first partition, host attributes of the first endpoint, virtualization attributes of the first endpoint, process attributes of processes initiating the first flows, or user attributes of process owners of the first flows.

5. The method of claim 3 , further comprising:
determining a portion of the network traffic data corresponds to a server load balancing algorithm.

6. The method of claim 2 , further comprising:
generating a first feature vector representing the first partition using at least one or more first features of a first endpoint of the first partition and one or more second features of a second endpoint of the first partition; and
determining a similarity between the one or more endpoints of the first partition and a third endpoint of the plurality of endpoints using at least the first feature vector and a second feature vector of the third endpoint.

7. The method of claim 1 , wherein the one or more network configurations include a subnetting schema, and the method further comprises:
determining a respective subnet mask for each of the plurality of endpoints,
wherein each of the plurality of partitions corresponds to a respective unique subnet mask.

8. The method of claim 7 , further comprising:
encoding data corresponding to the respective subnet mask of a first endpoint of the plurality of endpoints as a feature of the first endpoint.

9. The method of claim 1 , further comprising:
displaying at least a portion of the application dependency map that corresponds to a first application of the network as a set of clusters corresponding to the first application;
receiving a request for a different view of the portion of the application dependency map that corresponds to the first application; and
displaying the portion as a respective set of endpoints of each cluster of the set of clusters corresponding to the first application.

10. The method of claim 1 , further comprising:
displaying at least a portion of the application dependency map that corresponds to a first application of the network as a set of clusters corresponding to the first application;
receiving a selection of a first cluster of the set of clusters; and
displaying a set of endpoints of the first cluster.

11. A system comprising:
a processor; and
memory including instructions that, upon being executed by the processor, cause the system to:
capture network traffic data for a plurality of flows in a network using a plurality of sensors that includes at least a first sensor on a first physical server of the network, a second sensor on a virtual partition of the network, and a third sensor on a networking device of the network;
determine a plurality of endpoints of the network using the network traffic data;
partition the plurality of endpoints into a plurality of partitions based on one or more network configurations, the partitions including a first partition of endpoints for which there has been a user request for application dependency maps, and a second partition of endpoints that communicate with endpoints in the first partition but for which there has not been a user request for application dependency maps;
determine a respective plurality of clusters for each of the plurality of partitions using the network traffic data; and
generate an application dependency map using the respective plurality of clusters.

12. The system of claim 11 , wherein the one more network configurations include a load balancing schema, and the instructions upon being executed further cause the system to:
identify one or more endpoints forming a server farm corresponding to the load balancing schema,
wherein a first partition of the plurality of partitions includes the one or more endpoints.

13. The system of claim 12 , wherein the instructions upon being executed further cause the system to:
analyze the network traffic data to identify the load balancing schema.

14. The system of claim 13 , wherein the network traffic data includes one or more packet attributes of first flows of a first endpoint of the first partition, host attributes of the first endpoint, virtualization attributes of the first endpoint, process attributes of processes initiating the first flows, or user attributes of process owners of the first flows.

15. The system of claim 13 , wherein the instructions upon being executed further cause the system to:
determine a portion of the network traffic data corresponds to a server load balancing algorithm.

16. A non-transitory computer-readable medium having computer readable instructions that, upon being executed by a processor, cause the processor to:
capture network traffic data for a plurality of flows in a network using a plurality of sensors that includes at least a first sensor on a first physical server of the network, a second sensor on a virtual partition of the network, and a third sensor on a networking device of the network;
determine a plurality of endpoints of the network using the network traffic data;
partition the plurality of endpoints into a plurality of partitions based on one or more network configurations, the partitions including a first partition of endpoints for which there has been a user request for application dependency maps, and a second partition of endpoints that communicate with endpoints in the first partition but for which there has not been a user request for application dependency maps;
determine a respective plurality of clusters for each of the plurality of partitions using the network traffic data; and
generate an application dependency map using the respective plurality of clusters.

17. The non-transitory computer-readable medium of claim 16 , wherein the one or more network configurations include a subnetting schema, and the instructions upon being executed further cause the processor to:
determine a respective subnet mask for each of the plurality of endpoints,
wherein each of the plurality of partiti

Assignees

• Cisco Tech Inc

Inventors

• Parandehgheibi Ali
• Alizadeh Attar Mohammadreza
• Madani Omid
• Jeyakumar Vimalkumar
• Scheib Ellen Christine
• Yadav Navindra

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L43/0829

  Packet loss · CPC title