Representation of servers in a distributed network information management system for efficient aggregation of information

A computer readable non-transitory storage medium storing instructions for performing steps comprising:

• receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication;
• for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers;
• receiving a rule identifying a subset of the plurality of servers, a condition representative of an undesired traffic pattern in the communications between the subset of the plurality of servers to be evaluated by the rule, and an action to be taken in response to the condition being satisfied to remediate the undesired traffic pattern;
• for each of the subset of the plurality of servers, accessing respective unit network subgraphs;
• combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes;
• evaluating the condition specified in the rule based on the network subgraph to determine if the condition indicative of the undesired traffic pattern is satisfied;
• and
• responsive to the condition being satisfied, performing the one or more actions specified by the rule to remediate the undesired traffic pattern.

A computer system comprising:

• one or more processors;
• a computer readable non-transitory storage medium storing instructions for execution by the one or more processors, wherein the instructions perform the steps of:
• receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication;
• for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers;
• receiving a rule identifying a subset of the plurality of servers, a condition representative of an undesired traffic pattern in the communications between the subset of the plurality of servers to be evaluated by the rule, and an action to be taken in response to the condition being satisfied to remediate the undesired traffic pattern;
• for each of the subset of the plurality of servers, accessing respective unit network subgraphs;
• combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes;
• evaluating the condition specified in the rule based on the network subgraph to determine if the condition indicative of the undesired traffic pattern is satisfied;
• and
• responsive to the condition being satisfied, performing the one or more actions specified by the rule to remediate the undesired traffic pattern.

A method of processing network flow queries, the method comprising:

• receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication;
• for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers;
• receiving a query identifying a subset of the plurality of servers;
• for each of the subset of the plurality of servers, accessing respective unit network subgraphs;
• combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes;
• and
• sending information describing the network subgraph for presentation via a client device.