# US 12,113,690 B2 · Network path health scoring based on load binned latency data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,690 B2
- Document ID: US12113690B2
- Status: Granted
- Kind: B2
- Application number: 17/811,608
- Filed: 2022-07-11
- Published: 2023-03-30
- Granted: 2024-10-08
- Earliest claimed: 2021-09-23
- Assignees: Palo Alto Networks, Inc.
- Applicants: Palo Alto Networks, Inc.
- Inventors: Gopal Gadekal Reddy
- Web page: https://patentgrep.com/patent/US12113690B2

## CPC

- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L 43/0841: {Round trip packet loss}
- H04L 43/062: related to network traffic
- H04L 43/067: using time frame reporting
- H04L 43/0852: Delays
- H04L 43/0864: Round trip delays
- H04L 43/0882: Utilisation of link capacity
- H04L 43/0894: Packet rate
- H04L 43/106: using time related information in packets, e.g. by adding timestamps
- H04L 43/16: Threshold monitoring
- H04L 43/50: Testing arrangements
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A network path scoring system is disclosed herein that scores quality of network paths to facilitate identification of poorly performing network paths or circuits for investigation. The scoring system builds a profile of additional latencies of a network path binned by circuit load based on historical latency data for the network path. The additional latencies are determined with respect to a base latency of the network path. The network path scoring system determines a weighted average of the additional latencies of a subset of the load bins and a weighted average of expected latencies of the subset of load bins, and a score is calculated with these weighted averages.

## Claims

### Claim 1

A method comprising:
based on time-series latency data of a network path, determining observed additional latencies with respect to a base latency of the network path;
determining load of each of a plurality of time intervals of the time-series latency data;
binning the observed additional latencies by load;
determining an observed additional latency average for each load bin;
determining an average of the observed additional latency averages of a subset of the load bins;
determining an average of expected additional latencies of the subset of the load bins; and
scoring health of the network path based, at least in part, on the average of the observed additional latency averages and the average of expected additional latencies.

### Claim 2 (depends on 1)

The method of claim 1 further comprising determining the base latency for the network path for a time period of the time-series latency data.

### Claim 3 (depends on 2)

The method of claim 2, wherein determining the base latency comprises selecting a latency of a specified percentile of latency of the time-series latency data across the time period.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
determining whether the score is below a first threshold defined as indicating a low score;
based on determining that the score is a low score, identifying a lowest of the load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and updating the base latency to the observed additional latency average of the identified load bin;
determining second observed additional latencies with respect to the updated base latency;
binning by load the second observed additional latencies;
determining a second observed additional latency average for each load bin with the second observed additional latencies;
determining an average of the second observed additional latency averages of a subset of the load bins; and
re-scoring health of the network path based, at least in part, on the average of the second observed additional latency averages and the average of expected additional latencies.

### Claim 5 (depends on 2)

The method of claim 2, wherein determining the base latency comprises identifying a lowest of the load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and setting the base latency to the observed additional latency average of the identified load bin.

### Claim 6 (depends on 1)

The method of claim 1, wherein determining load of each of the plurality of time intervals of the time-series latency data is based, at least in part, on ingress and egress loads corresponding to the network path.

### Claim 7 (depends on 6)

The method of claim 6 further comprising determining the ingress and egress bandwidths of a network circuit associated with the network path, normalizing the load corresponding to the larger of ingress and egress bandwidths, and aggregating the ingress and egress loads after normalization, wherein determining the load is based on the aggregated ingress and egress loads.

### Claim 8 (depends on 1)

The method of claim 1, wherein scoring health of the network path comprises determining a ratio of the average of the observed additional latency averages and the average of expected additional latencies.

### Claim 9 (depends on 1)

The method of claim 1 further comprising scoring health of a second network path based, at least in part, on average of observed additional latency averages of the second network path and an average of expected additional latencies of the second network path, wherein the observed additional latency averages of the second network path are with respect to a base latency of the second network path.

### Claim 10 (depends on 9)

The method of claim 9 further comprising scoring health of a network circuit corresponding to the first and the second network paths, wherein scoring the health of the network circuit is based, at least in part, on scores of the first and second network paths.

### Claim 11 (depends on 1)

The method of claim 1 further comprising identifying the network path for bandwidth underutilization analysis based on the score of the first network path being below a poor score threshold and calculating throughput statistics for the network path based on application flow data to determine a maximum observed bandwidth utilization.

### Claim 12

A non-transitory, machine-readable medium having program code stored thereon, the program code comprising instructions to:
determine observed additional latencies with respect to a base latency of a network path based on time-series latency data of the network path;
determine circuit load of each of a plurality of time intervals of the time-series latency data based, at least in part, on both ingress and egress loads;
bin the observed additional latencies into corresponding ones of a plurality of load bins based, at least in part, on the determined circuit loads;
determine an observed additional latency average for each of the plurality of load bins;
determine an average of the observed additional latency averages of at least a subset of the plurality of load bins;
determine an average of expected additional latencies of the subset of the load bins; and
score health of the network path based, at least in part, on the average of the observed additional latency averages and the average of expected additional latencies.

### Claim 13 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein the instructions to score health of the network path comprise instructions to determine a ratio of the average of the observed additional latency averages and the average of expected additional latencies.

### Claim 14 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein the program code further comprises instructions to determine the base latency for the network path for a time period of the time-series latency data.

### Claim 15 (depends on 14)

The non-transitory machine-readable medium of claim 14, wherein the instructions to determine the base latency comprise instructions to select a latency of a specified percentile of latency of the time-series latency data across the time period.

### Claim 16 (depends on 15)

The non-transitory machine-readable medium of claim 15, wherein the program code further comprises instructions to:
determine whether the score is below a first threshold defined as indicating a low score;
based on a determination that the score is a low score, identify a lowest of the plurality of load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and update the base latency to the observed additional latency average of the identified load bin;
determine second observed additional latencies with respect to the updated base latency;
bin by circuit load the second observed additional latencies;
determine a second observed additional latency average for each of the plurality of load bins with the second observed additional latencies;
determine an average of the second observed additional latency averages of a second subset of the plurality of load bins; and
re-score health of the network path based, at least in part, on the average of the second observed additional latency averages and the average of expected additional latencies.

### Claim 17 (depends on 14)

The non-transitory machine-readable medium of claim 14, wherein the instructions to determine the base latency comprise instructions to identify a lowest of the load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and set the base latency to the observed additional latency average of the identified load bin.

### Claim 18 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein the program code further comprises instructions to determine the ingress and egress bandwidths of a network circuit associated with the network path, normalize the load corresponding to the larger of ingress and egress bandwidths, and aggregate the ingress and egress loads after normalization, wherein the instructions to determine the circuit load comprise the instructions to determine the circuit load based on the aggregated ingress and egress loads.

### Claim 19 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein the program code further comprises instructions to identify the network path for bandwidth underutilization analysis based on the score of the first network path being below a poor score threshold and to calculate throughput statistics for the network path based on application flow data to determine a maximum observed bandwidth utilization.

### Claim 20

An apparatus comprising:
a processor; and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
determine observed additional latencies with respect to a base latency of a network path based on time-series latency data of the network path;
determine circuit load of each of a plurality of time intervals of the time-series latency data based, at least in part, on both ingress and egress loads;
bin the observed additional latencies into corresponding ones of a plurality of load bins based, at least in part, on the determined circuit loads;
determine an observed additional latency average for each of the plurality of load bins;
determine an average of the observed additional latency averages of at least a subset of the plurality of load bins;
determine an average of expected additional latencies of the subset of the load bins; and
score health of the network path based, at least in part, on the average of the observed additional latency averages and the average of expected additional latencies.

### Claim 21 (depends on 20)

The apparatus of claim 20, wherein the program code further comprises instructions to determine the base latency for the network path for a time period of the time-series latency data.

### Claim 22 (depends on 21)

The apparatus of claim 21, wherein the instructions to determine the base latency comprise instructions to select a latency of a specified percentile of latency of the time-series latency data across the time period.

### Claim 23 (depends on 22)

The apparatus of claim 22, wherein the program code further comprises instructions to:
determine whether the score is below a first threshold defined as indicating a low score;
based on a determination that the score is a low score, identify a lowest of the plurality of load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and update the base latency to the observed additional latency average of the identified load bin;
determine second observed additional latencies with respect to the updated base latency;
bin by circuit load the second observed additional latencies;
determine a second observed additional latency average for each of the plurality of load bins with the second observed additional latencies;
determine an average of the second observed additional latency averages of a second subset of the plurality of load bins; and
re-score health of the network path based, at least in part, on the average of the second observed additional latency averages and the average of expected additional latencies.

### Claim 24 (depends on 21)

The apparatus of claim 21, wherein the instructions to determine the base latency comprise instructions to identify a lowest of the load bins with a subset of the observed additional latencies that satisfies a sufficiency criterion and set the base latency to the observed additional latency average of the identified load bin.

### Claim 25 (depends on 20)

The apparatus of claim 20, wherein the instructions to score health of the network path comprise instructions to determine a ratio of the average of the observed additional latency averages and the average of expected additional latencies.