Aggregation of select network traffic statistics

A computer-implemented method for aggregating network traffic statistics in a Wide Area Communication Network (WAN), the method comprising:

• determining a plurality of network flow strings that are transmitted from the network appliance or received at the network appliance,
• wherein the plurality of network flow strings are transmitted between two or more network appliances communicating via the WAN,
• wherein the two or more network appliances communicating via the WAN are physical or virtual network appliances deployed in the WAN, and
• wherein communications via the WAN are transmitted using a secure tunnel between the two or more network appliances using encryption, access control lists (ACLS), compression, fragmentation, and error detection and correction provided by the network appliance;
• extracting a network metric of the plurality of network flow strings;
• aggregating values associated with the network metric over the plurality of network flow strings;
• generating an accumulating map, wherein the accumulating map comprises the values associated with the aggregated network metric, wherein the accumulating map is associated with an eviction policy for determining when a record in the accumulating map is aggregated into a higher level record in the accumulating map, and
• wherein the higher level record removes low level technology in a hierarchy of devices in the communication network, keeps high level technology in the hierarchy of devices in the communication network, and creates the higher level record that is shorter in length than the record that included the low level technology;
• when a new network flow string is received, invoking the eviction policy on the new network flow string, wherein the eviction policy removes at least one of the plurality of network flow strings from the accumulating map;
• and
• transmitting the accumulating map, but not the plurality of network flow strings, to a network information collector in communication with the network appliance.

A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions when executed by the one or more processors cause the one or more processors to:

• determine a plurality of network flow strings that are transmitted from the network appliance or received at the network appliance,
• wherein the plurality of network flow strings are transmitted between two or more network appliances communicating via a Wide Area Communication Network (WAN),
• wherein the two or more network appliances communicating via the WAN are physical or virtual network appliances deployed in the WAN, and
• wherein communications via the WAN are transmitted using a secure tunnel between the two or more network appliances using encryption, access control lists (ACLS), compression, fragmentation, and error detection and correction provided by the network appliance;
• extract a network metric of the plurality of network flow strings;
• aggregate values associated with the network metric over the plurality of network flow strings;
• generate an accumulating map, wherein the accumulating map comprises the values associated with the aggregated network metric, wherein the accumulating map is associated with an eviction policy for determining when a record in the accumulating map is aggregated into a higher level record in the accumulating map, and
• wherein the higher level record removes low level technology in a hierarchy of devices in the communication network, keeps high level technology in the hierarchy of devices in the communication network, and creates the higher level record that is shorter in length than the record that included the low level technology;
• when a new network flow string is received, invoke the eviction policy on the new network flow string, wherein the eviction policy removes at least one of the plurality of network flow strings from the accumulating map;
• and
• transmit the accumulating map, but not the plurality of network flow strings, to a network information collector in communication with the network appliance.