Using keys to aggregate flow attributes at host

Patent metadata

Field	Value
Publication number	US-11188570-B2
Application number	US-201916520224-A
Country	US
Kind code	B2
Filing date	Jul 23, 2019
Priority date	Jul 23, 2019
Publication date	Nov 30, 2021
Grant date	Nov 30, 2021

Abstract

Some embodiments provide a novel method for collecting and reporting attributes of data flows associated with machines executing on a plurality of host computers to an analysis appliance. Each host computer, in some embodiments, is responsible for collecting and reporting attributes of data flows associated with machines executing on a host computer. The host computer, in some embodiments, first eliminates duplicative flow group records and then aggregates the flow data according to a set of received keys that specify attributes that define the aggregation. For example, a simple key that specifies a set of machine identifiers (e.g., a VM ID) as attribute values will, for each machine identifier, aggregate all flows with that machine identifier into a single aggregated flow group record. In some embodiments, the host computer includes a flow exporter that processes and publishes flow data to the analysis appliance.

First claim

We claim:

1. A method for collecting and reporting attributes of data flows associated with a set of one or more machines executing on a host computer, the method comprising:
identifying, during each of a plurality of time periods, a plurality of individual flows associated with the set of machines;
identifying, for each time period, a plurality of groups of one or more flows by using keys to associate individual flows into groups of flows, and storing attributes for each group based on attributes of each flow in the group; and
providing, after the plurality of time periods, the set of attributes for each group identified in the plurality of time periods to a server for further analysis of the data flows identified,
wherein a particular key specifies a set of attributes that are used to associate individual flows into groups of flows.

2. The method of claim 1 , wherein each group of flows is identified by a different set of key values, a key value comprising a set of attribute values for each attribute in the set of attributes specified by an associated key.

3. The method of claim 1 , wherein the particular key also specifies at least one condition that must be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows.

4. The method of claim 3 , wherein the condition specifies at least one range of values for the attribute value.

5. The method of claim 1 , wherein the particular key also specifies at least one condition that must not be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows.

6. The method of claim 5 , wherein the condition specifies a plurality of attribute values, wherein individual flows comprising any of the specified plurality of attribute values are not grouped into any group of flows for the key.

7. The method of claim 1 , wherein the particular key also specifies that a set of values for a particular attribute are considered equivalent when identifying, for an individual flow, a group of flows.

8. The method of claim 7 , wherein the set of values is a first set of values and is specified by specifying a second set of values that are not in the first set.

9. The method of claim 1 , wherein the particular key also specifies a set of collected attributes that are collected for each group of flows associated with the particular key.

10. The method of claim 9 , wherein the particular key also specifies a manner of combining, for each attribute, attribute values in each individual flow into a set of attributes for the group of flows.

11. The method of claim 10 , wherein for a particular attribute, attribute values are combined by identifying unique values for the attribute in the individual flows in the group of flows.

12. The method of claim 10 , wherein for a particular attribute, attribute values are combined by concatenating attribute values for the attribute from individual flows in the group of flows.

13. The method of claim 10 , wherein for a particular attribute, attribute values are combined by summing the attribute values for the attribute from each individual flow in the group of flows.

14. The method of claim 10 , wherein for a particular attribute, attribute values are combined by keeping an extreme attribute value for the attribute from the individual flows in the group of flows.

15. The method of claim 9 , wherein at least one of the set of attributes and the set of collected attributes is a contextual attribute for layers other than layers 2-7 of an open systems interconnection (OSI) model.

16. The method of claim 9 , wherein at least one of the set of attributes and the set of collected attributes is a statistic related to the individual flows that is generated on the host.

17. A method for collecting and reporting attributes of data flows associated with a set of one or more machines executing on a host computer, the method comprising:
identifying, during each of a plurality of time periods, a plurality of individual flows associated with the set of machines;
identifying, for each time period, a plurality of groups of one or more flows by using keys to associate individual flows into groups of flows, and storing attributes for each group based on attributes of each flow in the group;
providing, after the plurality of time periods, the set of attributes for each group identified in the plurality of time periods to a server for further analysis of the data flows identified; and
dynamically generating, for at least one particular key, a plurality of key values each of which is associated with a group of one or more identified individual flows,
wherein the generated plurality of key values identifies a plurality of groups of flows, with each group identified by each generated key value comprising the set of individual flows associated with the generated key value.

18. A method for collecting and reporting attributes of data flows associated with a set of one or more machines executing on a host computer, the method comprising:
identifying, during each of a plurality of time periods, a plurality of individual flows associated with the set of machines;
identifying, for each time period, a plurality of groups of one or more flows by using keys to associate individual flows into groups of flows, and storing attributes for each group based on attributes of each flow in the group; and
providing, after the plurality of time periods, the set of attributes for each group identified in the plurality of time periods to a server for further analysis of the data flows identified,
wherein each key has at least one associated value that is shared by all the flows in at least one group that is identified by using the key.

19. The method of claim 18 , wherein at least one associated value is provided to the host computer from another computer.

Assignees

• Vmware Inc

Inventors

• Jain Jayant
• Lu Russell
• Loi Ly
• Lund Rick
• Gopal Sushruth

Classifications

• G06F9/45541

  Bare-metal, i.e. hypervisor runs directly on hardware · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F16/285 Primary

  Clustering or classification · CPC title