# US 12,184,528 B2 · Methods and apparatus for adaptive and holistic network measurements > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,528 B2 - Document ID: US12184528B2 - Status: Granted - Kind: B2 - Application number: 18/198,691 - Filed: 2023-05-17 - Published: 2023-11-30 - Granted: 2024-12-31 - Earliest claimed: 2022-05-25 - Assignees: Ennetix Inc. - Applicants: Ennetix Inc. - Inventors: Pulak Kumar Chowdhury; Biswanath Mukherjee - Web page: https://patentgrep.com/patent/US12184528B2 ## CPC - H04L 43/06: Generation of reports - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/02: Capturing of monitoring data - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/045: for graphical visualisation of monitoring data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract One embodiment can provide a method and system for monitoring the performance of a network. During operation, the system can collect, from a network device, traffic data associated with a network; analyze the traffic data to discover dependencies among a plurality of applications and services accessed by client devices within the network; and identify, based on the discovered dependencies, a first server providing a first application and at least a second server providing a service that facilitates delivery of the first application. The system can further perform active measurement on the identified first server and at least the second server, thereby facilitating monitoring of performance of the first application. ## Claims ### Claim 1 A computer-implemented method, the method comprising: collecting, from a network device, traffic data associated with a network; applying a machine learning technique to analyze the traffic data to discover dependencies among a plurality of applications and services accessed by client devices within the network, wherein applying the machine learning technique comprises determining temporal and frequency correlations among packets associated with the plurality of applications and services, wherein determining the temporal correlation comprises determining whether packets destined for different applications and services are sent from a same client device within a predetermined interval, and wherein determining the frequency correlation comprises determining a number of client devices accessing each application or service; identifying, based on the discovered dependencies, a first server providing a first application and at least a second server providing a service that facilitates delivery of the first application; and performing active measurement on the first server and at least the second server, thereby facilitating monitoring of performance of the first application. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein collecting the traffic data comprises capturing packets belonging to different traffic flows passing through the network device; and wherein applying the machine learning technique comprises extracting flow information from headers of the captured packets and determining timing information associated with each flow. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein identifying the first and second servers comprises: for a respective application, determining a number of servers providing the respective application to client devices within the network; and identifying a most accessed server from the determined servers. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein performing the active measurement on a respective server comprises: generating a plurality of probe sequences based on an address of the respective server and a communication protocol implemented by the respective server; injecting the probe sequences into the network; and receiving and analyzing responses to the probe sequences to obtain information associated with intermediate nodes on one or more paths to the respective server. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein each probe sequence comprises a plurality of packets with incrementing time-to-live (TTL) values, and wherein packets within the probe sequence have a similar packet signature such that the packets follow a same path to the respective server. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising one or more of: displaying the discovered dependencies on a user interface; and displaying results of the active measurement on the user interface. ### Claim 7 A network monitoring system, comprising: a processor; and a storage device coupled to the processor and storing instructions that when executed by the processor cause the processor to perform a method, the method comprising: collecting, from a network device, traffic data associated with a network; applying a machine learning technique to analyze the traffic data to discover dependencies among a plurality of applications and services accessed by client devices within the network, wherein applying the machine learning technique comprises determining temporal and frequency correlations among packets associated with the plurality of applications and services, wherein determining the temporal correlation comprises determining whether packets destined for different applications and services are sent from a same client device within a predetermined interval, and wherein determining the frequency correlation comprises determining a number of client devices accessing each application or service; identifying, based on the discovered dependencies, a first server providing a first application and at least a second server providing a service that facilitates delivery of the first application; and performing active measurement on the first server and at least the second server, thereby facilitating monitoring of performance of the first application. ### Claim 8 (depends on 7) The network monitoring system of claim 7, wherein collecting the traffic data comprises capturing packets belonging to different traffic flows passing through the network device; and wherein applying the machine learning technique comprises extracting flow information from headers of the captured packets and determine timing information associated with each flow. ### Claim 9 (depends on 7) The network monitoring system of claim 7, wherein identifying the first and second servers comprises: for a respective application, determine a number of servers providing the respective application to client devices within the network; and identify a most accessed server from the determined servers. ### Claim 10 (depends on 7) The network monitoring system of claim 7, wherein performing the active measurement on a respective server comprises: generating a plurality of probe sequences based on an address of the respective server and a communication protocol implemented by the respective server; injecting the probe sequences into the network; and receiving and analyzing responses to the probe sequences to obtain information associated with intermediate nodes on one or more paths to the respective server. ### Claim 11 (depends on 10) The network monitoring system of claim 10, wherein each probe sequence comprises a plurality of packets with incrementing time-to-live (TTL) values, and wherein packets within the probe sequence have a similar packet signature such that the packets follow a same path to the respective server. ### Claim 12 (depends on 7) The network monitoring system of claim 7, further comprising a user interface to display one or more of: the discovered dependencies; and results of the active measurement. ### Claim 13 A non-transitory computer-readable storage medium storing instructions that when executed by a processor cause the processor to perform a method, the method comprising: collecting, from a network device, traffic data associated with a network; applying a machine learning technique to analyze the traffic data to discover dependencies among a plurality of applications and services accessed by client devices within the network, wherein applying the machine learning technique comprises determining temporal and frequency correlations among packets associated with the plurality of applications and services, wherein determining the temporal correlation comprises determining whether packets destined for different applications and services are sent from a same client device within a predetermined interval, and wherein determining the frequency correlation comprises determining a number of client devices accessing each application or service; identifying, based on the discovered dependencies, a first server providing a first application and at least a second server providing a service that facilitates delivery of the first application; and performing active measurement on the first server and at least the second server, thereby facilitating monitoring of performance of the first application. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein collecting the traffic data comprises capturing packets belonging to different traffic flows passing through the network device; and wherein applying the machine learning technique comprises extracting flow information from headers of the captured packets and determining timing information associated with each flow. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein identifying the first and second servers comprises: for a respective application, determining a number of servers providing the respective application to client devices within the network; and identifying a most accessed server from the determined servers. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein performing the active measurement on a respective server comprises: generating a plurality of probe sequences based on an address of the respective server and a communication protocol implemented by the respective server; injecting the probe sequences into the network; and receiving and analyzing responses to the probe sequences to obtain information associated with intermediate nodes on one or more paths to the respective server. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein each probe sequence comprises a plurality of packets with incrementing time-to-live (TTL) values, and wherein packets within the probe sequence have a similar packet signature such that the packets follow a same path to the respective server.