MDL-based clustering for dependency mapping

A network traffic monitoring system comprising:

• a collector and a machine-learning based analytics engine, wherein the collector receives network flow data relating to a plurality of endpoints, wherein each endpoint of the plurality of endpoints is a virtual machine, wherein each endpoint of the plurality of endpoints sends and/or receives packets via a virtual network interface dedicated to the endpoint, and wherein the machine-learning based analytics engine is configured to:
• analyze the network flow data to identify a first set of endpoints functioning together as a first distributed application, and create an application dependency graph, wherein nodes in the application dependency graph correspond to a first set of endpoints associated with the first distributed application and edges in the application dependency graph correspond to network flows described in the network flow data;
• and
• create at least one cluster of two or more nodes of the first distributed application based upon a similarity of their connections in the application dependency graph,
• wherein the collector receives network flow data relating to at least one additional endpoint, wherein the at least one additional endpoint is selected from a group containing a container, a hypervisor, a server, a network device, an external network, or a service, and wherein the network flow data from the at least one additional endpoint is based upon packets being sent and/or received via a network interface dedicated to the at least one additional endpoint.