Aggregation of select network traffic statistics

Patent metadata

Field	Value
Publication number	US-11757740-B2
Application number	US-202117161286-A
Country	US
Kind code	B2
Filing date	Jan 28, 2021
Priority date	Jun 13, 2016
Publication date	Sep 12, 2023
Grant date	Sep 12, 2023

Abstract

Disclosed herein are network information collectors, methods, computer-readable media, and systems for generating network traffic statistics. For example, the network appliance is to receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device; receive, via the network, additional accumulating maps from other network appliance devices; populate an accumulation map database with the accumulating map and the additional accumulating maps; and generate a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

First claim

What is claimed is:

1. A method for generating network traffic statistics comprising:
receiving, at a network information collector device via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device, the accumulating map being generated by:
for each flow from a first network appliance device, extracting a first attribute value of a first flow attribute,
for each flow from the first network appliance device, extracting a second attribute value of a second flow attribute,
building a hierarchical string with the extracted first attribute value and the extracted second attribute value, wherein the hierarchical string represents a subset of the network traffic statistics collected for the first network appliance device, and the second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string,
extracting at least one network metric for at least one network characteristic associated with the at least one hierarchical string,
aggregating the at least one network metric for the at least one network characteristic over a plurality of flows to and from the first network appliance device in the network,
implementing an eviction policy on lower level records and aggregating the lower level records into a higher level record of the hierarchical string, and
generating the accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for the first flow attribute and the second flow attribute of the hierarchical string,

the accumulating map being limited to a defined number of entries for a specified time period, and
the defined number of entries for the specified time period reducing an amount of the web traffic flow information collected;
receiving, at the network information collector device via the network, additional accumulating maps from other network appliance devices;
populating an accumulation map database with the accumulating map and the additional accumulating maps; and
generating a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

2. The method of claim 1 , wherein the accumulation map is encrypted and the method further comprises:
decrypting the accumulation map prior to populating the accumulation map database.

3. The method of claim 1 , wherein the accumulation map is compressed and the method further comprises:
initiating a request for additional data from the network appliance device and the other network appliance devices based on the compression.

4. The method of claim 1 , wherein the accumulating map is generated using the eviction policy that removes at least some of the web traffic flow information.

5. The method of claim 4 , wherein the eviction policy is a batch eviction of the web traffic flow information.

6. The method of claim 1 , wherein the accumulating map comprises an eviction log for collected information in excess of a target number of entries for the specified time period, the eviction log comprising a strings of information in excess of the target number of entries for the specified time period.

7. A network information collector for generating network traffic statistics, the network information collector to:
receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device, the accumulating map being generated by:
for each flow from a first network appliance device, extracting a first attribute value of a first flow attribute,
for each flow from the first network appliance device, extracting a second attribute value of a second flow attribute,
building at least one hierarchical string with the extracted first attribute value and the extracted second attribute value, wherein the hierarchical string represents a subset of the network traffic statistics collected for the first network appliance device, and the second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string,
extracting at least one network metric for at least one network characteristic associated with the at least one hierarchical string,
aggregating the at least one network metric for the at least one network characteristic over a plurality of flows to and from the first network appliance device in the network,

implementing an eviction policy on lower level records and aggregating the lower level records into a higher level record of the hierarchical string, and
generating the accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for the first flow attribute and the second flow attribute of the hierarchical string, the accumulating map being limited to a defined number of entries for a specified time period, and the defined number of entries for the specified time period reducing an amount of the web traffic flow information collected; receive, via the network, additional accumulating maps from other network appliance devices; populate an accumulation map database with the accumulating map and the additional accumulating maps; and generate a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

8. The network information collector of claim 7 , wherein the accumulation map is encrypted and the network information collector further to:
decrypt the accumulation map prior to populating the accumulation map database.

9. The network information collector of claim 7 , wherein the accumulation map is compressed and the network information collector further to:
initiate a request for additional data from the network appliance device and the other network appliance devices based on the compression.

10. The network information collector of claim 7 , wherein the accumulating map is generated using the eviction policy that removes at least some of the web traffic flow information.

11. The network information collector of claim 10 , wherein the eviction policy is a batch eviction of the web traffic flow information.

12. The network information collector of claim 7 , wherein the accumulating map comprises an eviction log for collected information in excess of a target number of entries for the specified time period, the eviction log comprising a strings of information in excess of the target number of entries for the specified time period.

13. A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions when executed by the one or more processors cause the one or more processors to:
receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device, the accumulating map being generated by:
for each flow from a first network appliance device, extracting a first attribute value of a first flow attribute,
for each flow from the first network appliance device, extracting a second attribute value of a second flow attribute,
building at least one hierarchical string with the extracted first attribute value and the extracted second attri

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Hughes David Anthony
• Singh Pawan Kumar

Classifications

• H04L43/062 Primary

  related to network traffic · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• H04L43/067

  using time frame reporting · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title