Method and system for detecting network upgrades

Patent metadata

Field	Value
Publication number	US-9444684-B2
Application number	US-88783010-A
Country	US
Kind code	B2
Filing date	Sep 22, 2010
Priority date	Sep 22, 2010
Publication date	Sep 13, 2016
Grant date	Sep 13, 2016

Abstract

A system and method identify a network upgrade from a data set including a plurality of configuration sessions. The system performs the method by receiving a plurality of configuration sessions. Each of the configuration sessions comprises a plurality of configuration commands. The configuration commands are generated by a same user identifier and within a time threshold. The method further includes identifying one of the configuration sessions as a network upgrade session. The identification is based on a rareness of the configuration session or a skewness of the configuration session.

First claim

What is claimed is:

1. A method, comprising:
receiving a plurality of configuration sessions, each of the configuration sessions comprising a plurality of configuration commands generated by a same user identifier and within a time threshold; and
identifying one of the configuration sessions as a network upgrade session, the identifying based on one of A) a rareness of the configuration session, and B) a skewness of the configuration session.

2. The method of claim 1 , wherein receiving the plurality of configuration sessions comprises:
receiving a plurality of configuration snapshots, each of the snapshots comprising information describing a configuration of a router at a corresponding time and date;
receiving a plurality of configuration commands, each of the commands having been sent to a router at a specified time and date;
generating a filtered plurality of configuration commands, wherein the filtered plurality of configuration commands is generated by removing, from the plurality of configuration commands, all configuration commands that do not correspond to a change between a first one of the configuration snapshots and a second one of the configuration snapshots; and
generating, from the filtered plurality of configuration commands, a plurality of configuration sessions, wherein each of the configuration sessions comprises one of the configuration commands generated by a same user identifier and within a time threshold.

3. The method of claim 1 , further comprising:
generating a plurality of de-parameterized configuration sessions by removing, from each of the configuration commands, one of an IP address, a device name, and a network mask;
dividing the configuration commands into a plurality of types of commands;
determining, for each of the types of commands, a number of routers that received a command of the type during a time period;
determining, for each of the types of commands, a number of instances of the type of command during the time period;
determining, for each of the types of commands, a normalized frequency count based on the number of routers and the number of instances;
identifying a type of commands as a rare type of commands if the normalized frequency count of the type is less than a threshold value; and
identifying one of the configuration sessions as a rare configuration session if it includes a command of a rare type of commands.

4. The method of claim 1 , further comprising:
determining a count of each of a plurality of types of configuration commands within each of the configuration sessions; and
identifying one of the configuration sessions as a skewed configuration session if one of the counts is greater than a threshold count.

5. The method of claim 4 , further comprising:
determining, for each of the configuration sessions, a mean of the counts and a standard deviation of the counts,
wherein the threshold count is determined based on the mean and the standard deviation.

6. The method of claim 5 , wherein the threshold count is the mean of the counts plus six times the standard deviation of the counts.

7. The method of claim 1 , wherein a configuration session is identified as a network upgrade session if it is a rare configuration session and a skewed configuration session.

8. The method of claim 1 , wherein the configuration commands are sent to a router in a network.

9. The method of claim 8 , wherein the network is the Internet.

10. A non-transitory computer readable storage medium storing a set of instructions executable by a processor, the set of instructions, when executed by the processor, causing the processor to perform operations comprising:
receiving a plurality of configuration sessions, each of the configuration sessions comprising a plurality of configuration commands generated by a same user identifier and within a time threshold; and
identifying one of the configuration sessions as a network upgrade session, the identifying based on one of A) a rareness of the configuration session, and B) a skewness of the configuration session.

11. The computer readable storage medium of claim 10 , wherein the operation of receiving the plurality of configuration sessions comprises sub-instructions comprising:
receiving a plurality of configuration snapshots, each of the snapshots comprising information describing a configuration of a router at a corresponding time and date;
receiving a plurality of configuration commands, each of the commands having been sent to a router at a specified time and date;
generating a filtered plurality of configuration commands, wherein the filtered plurality of configuration commands is generated by removing, from the plurality of configuration commands, all configuration commands that do not correspond to a change between a first one of the configuration snapshots and a second one of the configuration snapshots; and
generating, from the filtered plurality of configuration commands, a plurality of configuration sessions, wherein each of the configuration sessions comprises one of the configuration commands generated by a same user identifier and within a time threshold.

12. The computer readable storage medium of claim 10 , wherein the operations further comprise:
generating a plurality of de-parameterized configuration sessions by removing, from each of the configuration commands, one of an IP address, a device name, and a network mask;
dividing the configuration commands into a plurality of types of commands;
determining, for each of the types of commands, a number of routers that received a command of the type during a time period;
determining, for each of the types of commands, a number of instances of the type of command during the time period;
determining, for each of the types of commands, a normalized frequency count based on the number of routers and the number of instances;
identifying a type of commands as a rare type of commands if the normalized frequency count of the type is less than a threshold value; and
identifying one of the configuration sessions as a rare configuration session if it includes a command of a rare type of commands.

13. The computer readable storage medium of claim 10 , wherein the operations further comprise:
determining a count of each of a plurality of types of configuration commands within each of the configuration sessions; and
identifying one of the configuration sessions as a skewed configuration session if one of the counts is greater than a threshold count.

14. The computer readable storage medium of claim 13 , wherein the operations further comprise:
determining, for each of the configuration sessions, a mean of the counts and a standard deviation of the counts,
wherein the threshold count is determined based on the mean and the standard deviation.

15. The computer readable storage medium of claim 14 , wherein the threshold count is the mean of the counts plus six times the standard deviation of the counts.

16. The computer readable storage medium of claim 10 , wherein a configuration session is identified as a network upgrade session if it is a rare configuration session and a skewed configuration session.

17. The computer readable storage medium of claim 10 , wherein the configuration commands are sent to a router in a network.

18. The computer readable storage medium of claim 17 , wherein the network is the Internet.

19. A system, comprising:
a network recording device storing a data set including a plurality of configuration sessions for a plurality of network devices, each

Assignees

• Wang Jia
• Ge Zihui
• Mahimkar Ajay
• Shaikh Aman
• Yates Jennifer
• Zhang Yin
• Emmons Joanne
• At & T Ip I Lp

Inventors

• Wang Jia
• Ge Zihui
• Mahimkar Ajay
• Shaikh Aman
• Yates Jennifer
• Zhang Yin
• Emmons Joanne

Classifications

• H04L41/0869

  Validating the configuration within one network element · CPC title

• H04L41/0853 Primary

  by actively collecting configuration information or by backing up configuration information · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title