US 10,855,708 B1 · Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

Abstract

One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network. Another network monitoring device includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include multiple types of observable values as well as multiple types of combinations of multiple observable values. The network monitoring device maintains those data structures including information regarding historical activity of a network and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include observable values for multiple profile dimensions, including source/destination address, application, location, and time. The data structures also include observable values for combinations of more than one of those multiple profile dimensions, including, e.g., (source address)×(application), and the like. It is expected that only a relatively sparse set of combinations of more than one of those multiple profile dimensions would have meaningful information associated therewith. The network monitoring system maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

Claims20

Dependent claims

A network monitoring system comprising

a flow processing engine coupled to a communication network and capable of receiving network information from the communication network regarding communication flows within the communication network;
a network information buffer coupled to the flow processing engine;
a monitoring engine coupled to the network information buffer and capable of receiving at least some of the network information relating to activity of the communication network;
and
a database server that maintains a database of information for use by the monitoring engine, the database of information including at least a historical histogram of multidimensional crosspoints of a plurality of parameters regarding historical activity of the communication network, and an emergent histogram of multidimensional crosspoints of a plurality of parameters regarding emergent activity of the communication network;
wherein the database of information is used to detect abnormal network activity;
wherein at least one of the historical histogram or the emergent histogram includes a set of buckets disposed in a sequential order related to each of observable values;
and
wherein each set of buckets includes one bucket associated with a range of values for each of a plurality of dimensions associated with the multidimensional crosspoints.

6 more elements

A network monitoring method comprising:

using a flow processing engine coupled to a communication network to receive network information from the communication network regarding communication flows within the communication network;
coupling a network information buffer to the flow processing engine;
using a monitoring engine coupled to the network information buffer to receive at least some of the network information relating to activity of the communication network;
and
maintaining a database of information for use by the monitoring engine, the database of information including at least a historical histogram of multidimensional crosspoints of a plurality of parameters regarding historical activity of the communication network, and an emergent histogram of multidimensional crosspoints of a plurality of parameters regarding emergent activity of the communication network;
wherein the database of information is used to detect abnormal network activity wherein at least one of the historical histogram or the emergent histogram includes a set of buckets disposed in a sequential order related to each of observable values;
and
wherein each set of buckets includes one bucket associated with a range of values for each of a plurality of dimensions associated with the multidimensional crosspoints.

5 more elements

Dependencies are inferred from the claim text.

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

Life of this patent

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

Life of this patent

Abstract

Claims20