# US 10,374,961 B2 · System and method for management of cloud-based systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,961 B2 - Document ID: US10374961B2 - Status: Granted - Kind: B2 - Application number: 15/593,046 - Filed: 2017-05-11 - Published: 2017-11-02 - Granted: 2019-08-06 - Earliest claimed: 2012-02-06 - Assignees: Nokia of America Corporation - Applicants: Deepfield Networks Inc. - Inventors: Joseph E. Eggleston; Craig H. Labovitz - Web page: https://patentgrep.com/patent/US10374961B2 ## CPC - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 41/00: Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 41/508: {based on type of value added network service under agreement} - H04L 43/026: using flow identification - H04L 43/062: related to network traffic - H04L 43/0882: Utilisation of link capacity - H04L 47/10: Flow control; Congestion control - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract System and method for reporting usage of a network infrastructure includes obtaining a map that includes at least one flow-mapping that correlates a flow feature with a service and that correlates a flow feature with an endpoint type, wherein the endpoint types include at least a subscriber type and a service type; at a first computer, receiving flow telemetry of a network infrastructure, the flow telemetry representing at least the destination and source attributes for network traffic in the flow telemetry; categorizing the flow telemetry into at least a subscriber flow category based on the source and destination endpoint types of the traffic; for subscriber flow telemetry of a subscriber, processing the subscriber flow telemetry into at least one flow feature; identifying at least one service to attribute to at least a portion of the subscriber flow telemetry, the service identified through the processed flow feature and a flow-mapping. ## Claims ### Claim 1 A method for reporting usage of a network infrastructure comprising: performing by one or more computers: obtaining a map of a plurality of flow-mappings that each correlates a flow feature with an endpoint type, wherein the endpoint type is a subscriber or a service; receiving flow telemetry comprising a plurality of destination and source attributes for network traffic of the network infrastructure; determining a first flow feature associated with a first portion of the flow telemetry based on the map; and when a second flow feature cannot be determined for a second portion of the flow telemetry and the second portion of the flow telemetry is related to the first portion of the flow telemetry: assigning the first flow feature as the second flow feature associated with the second portion of the flow telemetry. ### Claim 2 (depends on 1) The method of claim 1, further comprising: consolidating duplicate flow telemetry. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining, based on the map and the flow telemetry, an amount of traffic driven by a type of service through the network infrastructure. ### Claim 4 (depends on 1) The method of claim 1, further comprising: categorizing the flow telemetry into at least one subscriber flow telemetry, wherein the first portion of the flow telemetry comprises a first portion of a subscriber flow telemetry for a subscriber. ### Claim 5 (depends on 4) The method of claim 4, wherein the map includes at least one flow-mapping that correlates a domain name to a service, and wherein categorizing the flow telemetry into at least one subscriber flow telemetry further comprises: identifying domain name service (DNS) recursive responses sent to the subscriber, wherein a recursive response identifies a component address that corresponds to a domain name; and identifying the first portion of the subscriber flow telemetry from the subscriber to the component address. ### Claim 6 (depends on 4) The method of claim 4, further comprising: identifying at least one service to attribute to the first portion of the subscriber flow telemetry. ### Claim 7 (depends on 6) The method of claim 6, wherein identifying the at least one service further comprises: identifying the at least one service for the first portion of the subscriber flow telemetry through a flow-mapping that correlates the first flow feature to the service. ### Claim 8 (depends on 4) The method of claim 4, further comprising: tracking combinations of component use as a flow feature. ### Claim 9 (depends on 8) The method of claim 8, wherein tracking combinations of component use comprises: tracking substantially simultaneous component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating at least two components of simultaneous usage to a service. ### Claim 10 (depends on 8) The method of claim 8, wherein tracking combinations of component use comprises: tracking a sequence of component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating a sequence of at least two components to a service. ### Claim 11 (depends on 8) The method of claim 8, wherein tracking combinations of component use comprises: tracking proportions of component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating usage proportion ranges of at least two components to a service. ### Claim 12 (depends on 8) The method of claim 8, wherein tracking combinations of component use comprises: tracking a traffic profile of a component accessed by the subscriber, and limiting possible identified services to services correlated with flow feature of the traffic profile. ### Claim 13 (depends on 1) The method of claim 1, further comprising: compiling data on services attributed to portions of the flow telemetry; and rendering the data in a service analytics interface. ### Claim 14 (depends on 1) The method of claim 1, wherein the flow feature in the map is one or more Internet Protocol (IP) addresses. ### Claim 15 A system comprising: one or more computers programmed to perform operations comprising: obtaining a map of a plurality of flow-mappings that each correlates a flow feature with an endpoint type, wherein the endpoint type is a subscriber or a service; receiving flow telemetry comprising a plurality of destination and source attributes for network traffic of the network infrastructure; determining a first flow feature associated with a first portion of the flow telemetry based on the map; and when a second flow feature cannot be determined for a second portion of the flow telemetry and the second portion of the flow telemetry is related to the first portion of the flow telemetry: assigning the first flow feature as the second flow feature associated with the second portion of the flow telemetry. ### Claim 16 (depends on 15) The system of claim 15, wherein the operations further comprise: consolidating duplicate flow telemetry. ### Claim 17 (depends on 15) The system of claim 15, wherein the operations further comprise: determining, based on the map and the flow telemetry, an amount of traffic driven by a type of service through the network infrastructure. ### Claim 18 (depends on 15) The system of claim 15, wherein the operations further comprise: categorizing the flow telemetry into at least one subscriber flow telemetry, wherein the first portion of the flow telemetry comprises a first portion of the subscriber flow telemetry for a subscriber. ### Claim 19 (depends on 18) The system of claim 18, wherein the map includes at least one flow-mapping that correlates a domain name to a service, and wherein categorizing the flow telemetry into at least one subscriber flow telemetry further comprises: identifying domain name service (DNS) recursive responses sent to the subscriber, wherein a recursive response identifies a component address that corresponds to a domain name; and identifying the first portion of the subscriber flow telemetry from the subscriber to the component address. ### Claim 20 (depends on 18) The system of claim 18, wherein the operations further comprise: identifying at least one service to attribute to the first portion of the subscriber flow telemetry.