Policy utilization analysis

Patent metadata

Field	Value
Publication number	US-11968103-B2
Application number	US-202117153785-A
Country	US
Kind code	B2
Filing date	Jan 20, 2021
Priority date	Jun 5, 2015
Publication date	Apr 23, 2024
Grant date	Apr 23, 2024

Abstract

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
receiving, at a traffic monitoring system from one or more sensors in a network, flow data associated with one of more packets traversing the network, wherein the flow data uniquely describes the one or more packets, wherein the traffic monitoring system includes a plurality of collectors for receiving the flow data from the one or more sensors, the plurality of collectors being respectively connected to one or more network devices in the network and outside a path the one or more packets are traversing;
determining, from the flow data, one or more endpoint groups associated with the one or more packets;
determining, by the traffic monitoring system, whether a first policy was enforced on the one or more packets based at least on part on whether a packet of the one or more packets was blocked or allowed at an endpoint of the one or more endpoint groups, wherein the first policy is associated with the one or more endpoint groups;
in response to the first policy being enforced, updating, by traffic monitoring system, utilization data for the first policy in a policy table;
determining, based on a comparison of utilization data in the policy table, whether the first policy is utilized more than a second policy; and
in response to determining that the first policy is utilized more than the second policy, reordering, by traffic monitoring system, a first position of the first policy and a second position of the second policy in the policy table.

2. The method of claim 1 , further comprising:
in response to determining that the first policy is not utilized more than the second policy, determining if the first policy has not been utilized for a period of time; and
in response to determining that the first policy has not been utilized for the period of time, deleting the first policy from the policy table.

3. The method of claim 2 , wherein the first policy is a whitelist policy.

4. The method of claim 1 , further comprising:
determining whether the first policy was enforced for the flow data.

5. The method of claim 4 , wherein determining whether the first policy was enforced based on the flow data received at a destination and/or sent by a source.

6. The method of claim 1 , wherein the flow data comprises data that is received from a network device, a hypervisor, a container, or a virtual machine.

7. The method of claim 1 , further comprising:
presenting the utilization data of the first policy including at least one of a number of flows, a number of packets, or a quantity of data received by a network in relation to a period of time.

8. The method of claim 1 , further comprising:
receiving additional flow data;
determining whether the first policy is applicable to the additional flow data.

9. The method of claim 8 , wherein the first policy is configured to deny connectivity from a source and/or a destination, the method further comprising:
determining that connectivity was allowed from the source and/or to the destination; and
providing an alert indicating that the first policy was not applied.

10. The method of claim 8 , wherein the first policy is configured to deny connectivity from a source and/or a destination, the method further comprising:
determining that connectivity was denied from the source and/or to the destination; and
updating the utilization data for the first policy.

11. A system comprising:
at least one processor; and
at least one memory storing instructions, which when executed by the at least one processor, causes the at least one processor to:
receive, from one or more sensors in a network, flow data associated with one of more packets traversing the network, wherein the flow data uniquely describes the one or more packets, wherein the system includes a plurality of collectors for receiving the flow data from the one or more sensors, the plurality of collectors being respectively connected to one or more network devices in the network and outside a path the one or more packets are traversing;
determine, from the flow data, one or more endpoint groups associated with the one or more packets;
determine whether a first policy was enforced on the one or more packets based at least on part on whether a packet of the one or more packets was blocked or allowed at an endpoint of the one or more endpoint groups, wherein the first policy is associated with the one or more endpoint groups;
in response to the first policy being enforced, update utilization data for the first policy in a policy table;
determine, based on a comparison of utilization data in the policy table, whether the first policy is utilized more than a second policy; and
in response to determining that the first policy is utilized more than the second policy, reorder a first position of the first policy and a second position of the second policy in the policy table.

12. The system of claim 11 , further comprising instructions which when executed by the at least one processor, causes the at least one processor to:
in response to determining that the first policy is not utilized more than the second policy, determine if the first policy has not been utilized for a period of time; and
in response to determining that the first policy has not been utilized for the period of time, delete the first policy from the policy table.

13. The system of claim 12 , wherein the first policy is a whitelist policy.

14. The system of claim 11 , wherein the flow data comprises data that is received from a network device, a hypervisor, a container, or a virtual machine.

15. The system of claim 11 , further comprising instructions which when executed by the at least one processor, causes the at least one processor to:
present the utilization data of the first policy including at least one of a number of flows, a number of packets, or a quantity of data received by a network in relation to a period of time.

16. The system of claim 11 , further comprising instructions which when executed by the at least one processor, causes the at least one processor to:
receive additional flow data;
determine whether the first policy is applicable to the additional flow data.

17. The system of claim 16 , wherein the first policy is configured to deny connectivity from a source and/or a destination, the system further comprising instructions which when executed by the at least one processor, causes the at least one processor to:
determine that connectivity was allowed from the source and/or to the destination; and
provide an alert indicating that the first policy was not applied.

18. The system of claim 16 , wherein the first policy is configured to deny connectivity from a source and/or a destination, the system further comprising instructions which when executed by the at least one processor, causes the at least one processor to:
determining that connectivity was denied from the source and/or to the destination; and
updating the utilization data for the first policy.

19. At least one non-transitory computer-readable medium storing instructions, which when executed by at least one processor of a system, causes the system to:
receive, from one or more sensors in a network, flow data associated with one of more packets traversing the network, wherein the flow data uniquely describes the one or more packets, wherein the system includes plurality of collectors for receiving the flow data from the one or more sensors, the plurality of collectors being respectively connected to one or more

Assignees

• Cisco Tech Inc

Inventors

• Gupta Sunil Kumar
• Yadav Navindra
• Watts Michael Standish
• Parandehgheibi Ali
• Gandham Shashidhar
• Kulshreshtha Ashutosh
• Deen Khawar

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L67/01

  Protocols · CPC title