Aggregation of select network traffic statistics

Patent metadata

Field	Value
Publication number	US-12355645-B2
Application number	US-202318166735-A
Country	US
Kind code	B2
Filing date	Feb 9, 2023
Priority date	Jun 13, 2016
Publication date	Jul 8, 2025
Grant date	Jul 8, 2025

Abstract

Disclosed herein are network information collectors, methods, computer-readable media, and systems for generating network traffic statistics. For example, the network appliance is to receive, via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device; receive, via the network, additional accumulating maps from other network appliance devices; populate an accumulation map database with the accumulating map and the additional accumulating maps; and generate a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.

First claim

What is claimed is:

1. A method for aggregating select network traffic statistics for a plurality of network appliances connected in a communication network, the method comprising:
receiving a first data flow comprising a first attribute value and a second data flow comprising a second attribute value;
building a hierarchical string by combining the first attribute value that is extracted from the first data flow as a source identifier and the second attribute value that is extracted from the second data flow as a destination identifier, the hierarchical string representing network traffic statistics collected for a network appliance in the plurality of network appliances with the hierarchical string comprising the first attribute value and the second attribute value;
generating an accumulating map that is updated in substantially real time,
the accumulating map comprising the hierarchical string and aggregated network metrics,
the accumulating map having a target number of entries for a specified time period and an eviction policy determining how information is aggregated once the accumulating map reaches its target number of entries for the specified time period,
the eviction policy of the accumulating map comprising:
identifying lower level information and higher level information of the hierarchical string in a first record, the lower level information comprising the source identifier or the destination identifier of the hierarchical string, and the higher level information comprising a combination of attributes of the source identifier or the destination identifier, and
in response to identifying a second record with a same higher level information, aggregating the first record and second record as a combined record and removing the lower level information from the combined record;

the first record and the second record being evicted from the accumulating map automatically at the specified time period in accordance with the eviction policy and the combined record remaining in the accumulating map; and

transmitting the accumulating map to a network information collector in communication with the network appliance.

2. The method of claim 1 , wherein information regarding each flow to or from a given network appliance in the plurality of network appliances is collected in a flow table.

3. The method of claim 1 , wherein the first attribute value and the second attribute value are extracted at a first time interval.

4. The method of claim 1 , wherein the accumulating map is transmitted to the network information collector at a second time interval, the second time interval being a different amount of time than a first time interval.

5. The method of claim 1 , wherein a new accumulating map is started at the network appliance after the aggregated information is transmitted to the network information collector.

6. The method of claim 1 , wherein the accumulating map comprises an eviction log for collected information in excess of the target number of entries for the specified time period, the eviction log comprising a summary of strings of information in excess of the target number of entries for the specified time period.

7. The method of claim 1 , wherein the eviction policy determines that once the target number of entries is reached for the specified time period, any new information collected will be discarded and not aggregated during that time period.

8. The method of claim 1 , wherein the eviction policy further determines that an evicted record is moved to an eviction log when aggregated into a higher level record of the accumulating map.

9. The method of claim 1 , wherein the eviction policy determines that a portion of the hierarchical string is removed from the accumulating map to reduce the number of entries below a maximum number of entries for the specified time period.

10. The method of claim 1 , wherein the eviction policy removes a predetermined number of records from the accumulating map and moves them to an eviction log when a maximum number of entries for the specified time period is reached.

11. The method of claim 1 , further comprising:
in response to a query regarding network traffic from a user, displaying a portion of the information collected from the plurality of network appliances on a graphical user interface to the user.

12. The method of claim 1 , wherein the aggregated information is stored in bins.

13. The method of claim 1 , further comprising:
for each flow from the network appliance, extracting a second network metric of the first attribute value and its corresponding value.

14. A system for aggregating select network traffic statistics, comprising:
a plurality of network appliances in a communication network, each of the plurality of network appliances configured to:
receive a first data flow comprising a first attribute value and a second data flow comprising a second attribute value;
build a hierarchical string by combining the first attribute value that is extracted from the first data flow as a source identifier and the second attribute value that is extracted from the second data flow as a destination identifier, the hierarchical string representing network traffic statistics collected for a network appliance in the plurality of network appliances with the hierarchical string comprising the first attribute value and the second attribute value;
generate an accumulating map that is updated in substantially real time,
the accumulating map comprising the hierarchical string and aggregated network,
the accumulating map having a target number of entries for a specified time period and an eviction policy determining how information is aggregated once the accumulating map reaches its target number of entries for the specified time period,
the eviction policy of the accumulating map comprising:
identifying lower level information and higher level information of the hierarchical string in a first record, the lower level information comprising the source identifier or the destination identifier of the hierarchical string, and the higher level information comprising a combination of attributes of the source identifier or the destination identifier, and
in response to identifying a second record with a same higher level information, aggregating the first record and second record as a combined record and removing the lower level information from the combined record;

the first record being evicted from the accumulating map automatically at the specified time period in accordance with the eviction policy and the combined record remaining in the accumulating map; and

transmit the accumulating map to a network information collector in communication with the network appliance; and

the network information collector configured to receive the accumulating map from each of the plurality of network appliances.

15. The system of claim 14 wherein the network information collector is further configured to store the information in one or more databases.

16. The system of claim 14 wherein each of the plurality of network appliances further generates at least one indexing data structure for the accumulating map.

17. The system of claim 14 , wherein the first attribute value and the second attribute value are extracted at a first time interval.

18. The system of claim 14 , wherein the accumulating map is transmitted to the network information collector at a second time interval, the second time interval being a different amount of time than a first time interval at which the first attribute value and the second attri

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Hughes David Anthony
• Singh Pawan Kumar

Classifications

• H04L43/026

  using flow identification · CPC title

• G06F16/284

  Relational databases · CPC title

• G06F16/248

  Presentation of query results · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• H04L43/067

  using time frame reporting · CPC title