Technologies for annotating process and user information for network flows

A method of monitoring network traffic, the method comprising:

• receiving at a collector, network flow data via an attached communications network;
• evaluating the network flow data to derive a directed control flow graph corresponding to a distributed application, the control flow graph including a plurality of nodes and a plurality of edges between various nodes, wherein:
• the nodes of the graph correspond to network-addressable application components connected to the communications network, each application component sending and receiving network traffic including one or more packets at a network interface;
• one or more of the application components includes a workload creating and/or processing a data stream as part of the distributed application;
• and
• edges between the nodes of the graph correspond to data streams between source nodes and destination nodes;
• annotating one or more flows associated with one or more nodes and/or edges in the control flow graph with one or more tags, the tags relating to a functioning of the distributed application;
• identifying a pattern of normal behavior of the distributed application;
• evaluating newly received network flow data using the pattern;
• identifying a change in conditions, the change in conditions including at least one of network traffic that varies from the normal behavior expected by the pattern and a change in the control flow graph;
• and
• responding to the change in conditions.

One or more non-transitory computer-readable media having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:

• receive, at a collector, network flow data via an attached communications network;
• evaluate the network flow data to derive a directed control flow graph corresponding to a distributed application, the control flow graph including a plurality of nodes and a plurality of edges between various nodes, wherein:
• the nodes of the graph correspond to network-addressable application components connected to the communications network, each application component sending and receiving network traffic including one or more packets at a network interface;
• one or more of the application components includes a workload creating and/or processing a data stream as part of the distributed application;
• and
• edges between the nodes of the graph correspond to data streams between source nodes and destination nodes;
• annotate one or more flows associated with one or more nodes and/or edges in the control flow graph with one or more tags, the tags relating to a functioning of the distributed application;
• identify a pattern of normal behavior of the distributed application;
• evaluate newly received network flow data using the pattern;
• identify a change in conditions, the change in conditions including at least one of network traffic that varies from the normal behavior expected by the pattern and a change in the control flow graph;
• and
• respond to the change in conditions.