Discovering communication rules in a network trace
AssigneeMicrosoft Corporation
InventorsRanveer Chandra, Srikanth Kandula
Life of this patent
Estimating the term…
Abstract
The claimed subject matter provides a system and/or a method that facilitates managing a network by mining a communication rule. An analysis engine can employ a packet trace within a network in order to provide timing information, wherein the network includes at least one of a host, a protocol, or an application. A traffic evaluator can extract a communication rule for the network based upon an activity matrix generated from the timing information in which the activity matrix includes at least one of a row of a time window for the packet trace and a column for a flow in the packet trace.
Claims20
A system that facilitates managing a network by mining communication rules, comprising:
- an analysis engine that looks at a portion of network traffic related to a network in order to obtain timing information, wherein the network includes at least one of a host, a protocol, or an application;
- a traffic evaluator that extracts communication rules for the network, the communication rule is a representation of an underlying dependency between two or more flows as manifested in network traffic and the communication rule is mined by the traffic evaluator to identify such underlying dependency;
- and
- the traffic evaluator leverages the communication rule(s) to provide network management, the network management is at least one of a network monitoring, a network diagnosis, or a network intrusion detection.
A computer-implemented method that facilitates managing a network, comprising:
- receiving a portion of data associated with a packet trace on a network;
- generating an activity matrix from the packet trace to identify the activity of traffic flows between a source and a destination within the network;
- utilizing a template to instantiate pluralities that abstract away parts of the flows the template is created based at least in part upon a portion of data related to the activity matrix;
- and
- generating a communication rule that might include either flows or pluralities.
A computer-implemented system that facilitates managing a network by leveraging data mining, comprising:
- means for employing a packet trace within a network in order to provide timing information, the network includes at least one of a host, a protocol, or an application;
- means for generating an activity matrix from the timing information, the activity matrix includes at least one of a row for a time window in the packet trace and a column for a flow in the packet trace;
- means for extracting a communication rule for the network;
- means for filtering at least one extracted communication rule in accordance with a threshold;
- means for utilizing the communication rule to provide information related to data packet traffic within the network;
- means for utilizing the communication rule to detect a configuration error within the network;
- and
- means for utilizing the communication rule to detect malicious traffic within the network.
Dependencies are inferred from the claim text.