# US 10,320,617 B2 · Representation of servers in a distributed network information management system for efficient aggregation of information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,617 B2 - Document ID: US10320617B2 - Status: Granted - Kind: B2 - Application number: 15/263,193 - Filed: 2016-09-12 - Published: 2018-03-15 - Granted: 2019-06-11 - Earliest claimed: 2016-09-12 - Assignees: Illumio, Inc. - Applicants: Illumio, Inc. - Inventors: Joel E. VanderKwaak - Web page: https://patentgrep.com/patent/US10320617B2 ## CPC - H04L 41/0894: Policy-based network configuration management - H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Communications between servers of a network are received and processed to generate network subgraphs. The network subgraph may be used for implementing administrative domain wide policies, for presenting information on a user interface, or for other purposes. A unit network subgraph is generated for each server. The unit network subgraph represents communications of the server with other servers. A network subgraph is generated by aggregating information of unit network subgraphs servers included in the network subgraph. The network subgraph may be used to evaluate an expression specified by an administrative domain wide policy. The result of evaluation of the expression may be used to determine whether actions specified by the policy are executed. The network subgraph may be used for processing network flow queries, for example, for displaying network information on a user interface. ## Claims ### Claim 1 A method for remediating an undesired traffic pattern detected based on network subgraphs, the method comprising: receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication; for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers; receiving a rule identifying a subset of the plurality of servers, a condition representative of an undesired traffic pattern in the communications between the subset of the plurality of servers to be evaluated by the rule, and an action to be taken in response to the condition being satisfied to remediate the undesired traffic pattern; for each of the subset of the plurality of servers, accessing respective unit network subgraphs; combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes; evaluating the condition specified in the rule based on the network subgraph to determine if the condition indicative of the undesired traffic pattern is satisfied; and responsive to the condition being satisfied, performing the one or more actions specified by the rule to remediate the undesired traffic pattern. ### Claim 2 (depends on 1) The method of claim 1, wherein an edge of the network subgraph associated with a first server and a second server is a detailed edge, the detailed edge comprising representations of a plurality of communications between the first server and a second server. ### Claim 3 (depends on 1) The method of claim 1, wherein an edge of the network subgraph associated with a first server and a second server is a summary edge, the summary edge associated with an aggregate value based on a plurality of communications between the first server and a second server. ### Claim 4 (depends on 1) The method of claim 1, wherein generating the unit network subgraph comprises: receiving, from a first source server, a first communication represented as an identifier of the first source server and an identifier of a first destination server; determining whether the unit network subgraph includes a representation of the first destination server; and responsive to determining that the unit network subgraph does not include a representation of the first destination server, adding the representation of the first destination server to the unit network subgraph. ### Claim 5 (depends on 4) The method of claim 4, wherein generating the unit network subgraph comprises: determining whether the unit network subgraph includes a representation of an edge from the first source server to the first destination server; responsive to determining that the unit network subgraph does not include a representation of an edge from the first source server to the first destination server, adding a representation of the edge from the first source server to the first destination server, the representation of the edge comprising information describing the first communication; and responsive to determining that the unit network subgraph includes a representation of an edge from the first source server to the first destination server, updating the representation of the edge based on the first communication. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the unit network subgraphs is performed in parallel by a plurality of processors, wherein a first set of unit network subgraphs is generated by a first processor and a second set of unit network subgraphs is generated by a second processor. ### Claim 7 (depends on 1) The method of claim 1, wherein generating the unit network subgraph comprises: storing label sets for each of the plurality of servers; and identifying the subset of the plurality of servers based on the label sets. ### Claim 8 A computer readable non-transitory storage medium storing instructions for performing steps comprising: receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication; for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers; receiving a rule identifying a subset of the plurality of servers, a condition representative of an undesired traffic pattern in the communications between the subset of the plurality of servers to be evaluated by the rule, and an action to be taken in response to the condition being satisfied to remediate the undesired traffic pattern; for each of the subset of the plurality of servers, accessing respective unit network subgraphs; combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes; evaluating the condition specified in the rule based on the network subgraph to determine if the condition indicative of the undesired traffic pattern is satisfied; and responsive to the condition being satisfied, performing the one or more actions specified by the rule to remediate the undesired traffic pattern. ### Claim 9 (depends on 8) The computer readable non-transitory storage medium of claim 8, wherein an edge of the network subgraph associated with a first server and a second server is a detailed edge, the detailed edge comprising representations of a plurality of communications between the first server and a second server. ### Claim 10 (depends on 8) The computer readable non-transitory storage medium of claim 8, wherein an edge of the network subgraph associated with a first server and a second server is a summary edge, the summary edge associated with an aggregate value based on a plurality of communications between the first server and a second server. ### Claim 11 (depends on 8) The computer readable non-transitory storage medium of claim 8, wherein generating the unit network subgraph comprises: receiving, from a first source server, a first communication represented as an identifier of a first source server and an identifier of a first destination server; determining whether the unit network subgraph includes a representation of the first destination server; and responsive to determining that the unit network subgraph does not include a representation of the first destination server, adding a representation of the first destination server to the unit network subgraph. ### Claim 12 (depends on 11) The computer readable non-transitory storage medium of claim 11, wherein generating the unit network subgraph comprises: determining whether the unit network subgraph includes a representation of an edge from the first source server to the first destination server; responsive to determining that the unit network subgraph does not include a representation of an edge from the first source server to the first destination server, adding a representation of the edge from the first source server to the first destination server, the representation of the edge comprising information describing the first communication; and responsive to determining that the unit network subgraph includes a representation of an edge from the first source server to the first destination server, updating the representation of the edge based on the first communication. ### Claim 13 (depends on 8) The computer readable non-transitory storage medium of claim 8, wherein generating the unit network subgraphs is performed in parallel by a plurality of processors, wherein a first set of unit network subgraphs is generated by a first processor and a second set of unit network subgraphs is generated by a second processor. ### Claim 14 (depends on 8) The computer readable non-transitory storage medium of claim 8, wherein generating the unit network subgraph comprises: storing label sets for each of the plurality of servers; and identifying the subset of the plurality of servers based on the label sets. ### Claim 15 A computer system comprising: one or more processors; a computer readable non-transitory storage medium storing instructions for execution by the one or more processors, wherein the instructions perform the steps of: receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication; for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers; receiving a rule identifying a subset of the plurality of servers, a condition representative of an undesired traffic pattern in the communications between the subset of the plurality of servers to be evaluated by the rule, and an action to be taken in response to the condition being satisfied to remediate the undesired traffic pattern; for each of the subset of the plurality of servers, accessing respective unit network subgraphs; combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes; evaluating the condition specified in the rule based on the network subgraph to determine if the condition indicative of the undesired traffic pattern is satisfied; and responsive to the condition being satisfied, performing the one or more actions specified by the rule to remediate the undesired traffic pattern. ### Claim 16 A method of processing network flow queries, the method comprising: receiving information describing communications between a plurality of servers interacting via a network, each communication associated with an identifier of a source server, an identifier of a destination server, and one or more attributes describing the communication; for each server of the plurality of servers, generating a unit network subgraph representing communications associated with the server, the unit network subgraph comprising a node representing the server and one or more edges describing communications of the server with other servers; receiving a query identifying a subset of the plurality of servers; for each of the subset of the plurality of servers, accessing respective unit network subgraphs; combining the respective unit network subgraphs for the subset of the plurality of servers identified by the rule to generate a network subgraph representing the subset of the plurality of servers as nodes and representing communications between the subset of the plurality of servers as edges between the nodes; and sending information describing the network subgraph for presentation via a client device.