Distributed and adaptive computer network analytics

Patent metadata

Field	Value
Publication number	US-10305759-B2
Application number	US-201514589953-A
Country	US
Kind code	B2
Filing date	Jan 5, 2015
Priority date	Jan 5, 2015
Publication date	May 28, 2019
Grant date	May 28, 2019

Abstract

A network analytics controller in a computer network receives specification of a network analysis task. The controller creates maplets. Each maplet corresponds to an agent executing on a network node in the computer network. Each maplet specifies the network data collection configuration, collected data processing, and processed data reporting to be performed to support the network analysis task at the node executing the corresponding agent. The controller communicates the maplet corresponding to the agent over the computer network to each agent. Each agent receiving a maplet configures its corresponding network node for network data collection, collected data processing, and processed data reporting in accordance with the received maplet. Each agent receiving a maplet collects and processes network data, and reports the processed data to the controller, in accordance with the configuration. The controller aggregates, as the result of the network analysis task, the data reported from each agent.

First claim

We claim:

1. A method, comprising:
receiving, by a network analytics controller in a computer network, a specification of a network analysis task;
creating, by the network analytics controller, a plurality of maplets, each maplet:
corresponding to an agent executing on a particular network node in the computer network, and
specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicating, by the network analytics controller over the computer network to each agent executing on a particular network node, the maplet corresponding to the agent;
configuring, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;
collecting network data and processing the collected network data, by each agent receiving a maplet, in accordance with the configuration;
reporting, to the network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;
modifying, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and
aggregating, by the network analytics controller, the data reported from each agent receiving a maplet, as a result of the specified network analysis task.

2. The method of claim 1 , wherein the first maplet and the second maplet are the same maplet.

3. The method of claim 1 , wherein the first maplet and the second maplet are different maplets.

4. The method of claim 1 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

5. Logic encoded on one or more non-transitory tangible media for execution and when executed operable to:
receive a specification of a network analysis task in a computer network;
create a plurality of maplets, each maplet:
corresponding to an agent executing on a particular network node in the computer network, and
each maplet specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicate, over the computer network to each agent executing on a particular network node, the maplet corresponding to the agent;
configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;
collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration;
report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;
modify, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and
aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

6. The logic of claim 5 , wherein the first maplet and the second maplet are the same maplet.

7. The logic of claim 6 , wherein the first maplet and the second maplet are different maplets.

8. The logic of claim 5 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

9. A system, comprising:
a storage device; and
a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to:
receive a specification of a network analysis task in a computer network;
create a plurality of maplets, each maplet:
corresponding to an agent executing on a particular network node in the computer network; and
specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicate, over the computer network to each particular executing on a particular network node, the maplet corresponding to the particular;
configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;
collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration;
report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;
modify, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and
aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

10. The system of claim 9 , wherein the first maplet and the second maplet are the same maplet.

11. The system of claim 10 , wherein the first maplet and the second maplet are different maplets.

12. The system of claim 9 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

13. The system of claim 9 wherein:
the application code instructions that cause the system to receive a specification of a network analysis task, create a plurality of maplets to support the specified task, communicate each maplet to a particular, and aggregate the data reported from each agent, are executed by a network analyti

Assignees

• Cisco Tech Inc

Inventors

• Clemm Ludwig Alexander
• Chandramouli Yegnanarayanan
• Krishnamurthy Saileshwar

Classifications

• H04L41/046 Primary

  comprising network management agents or mobile agents therefor · CPC title

• H04L41/0803

  Configuration setting · CPC title

• H04L41/0886

  Fully automatic configuration · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• H04L43/06 Primary

  Generation of reports · CPC title