Detecting Network Services Based On Network Flow Data

A computer-implemented method comprising:

• generating pair data comprising matching pairs of network flows;
• for each endpoint of a set of endpoints comprising at least one endpoint selected from a plurality of endpoints of the network:
• determining a plurality of peers of the endpoint based on the pair data;
• determining a difference metric of the endpoint based on the pair data, wherein the difference metric is based on differences, for each peer of at least a subset of the plurality of peers, between the number of peers of the endpoint and the number of peers of each peer;
• determining a set of service endpoints based on the difference metric of each endpoint in the set of endpoints;
• filtering, from the set of service endpoints, zero or more endpoints determined to correspond to a scan from a fixed port;
• filtering, from the set of service endpoints, zero or more endpoints determined to correspond to peer-to-peer traffic;
• performing network analysis of the network based on the set of service endpoints.

A data processing apparatus comprising:

• one or more processors;
• one or more interfaces that are configured to couple to a communications network;
• one or more non-transitory computer-readable storage media storing one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform:
• using a networking device, obtaining network flow data for a plurality of computing devices comprising a plurality of endpoints of a telecommunications network, wherein each endpoint of the plurality of endpoints is uniquely described by data comprising an IP address, a port, and a communication protocol;
• for each endpoint of a set of at least one endpoint selected from the plurality of endpoints, determining a plurality of peers of the endpoint by detecting communication between the endpoint and the plurality of peers based on the network flow data;
• for each peer of a set of peers selected from the plurality of peers, determining, based on the network flow data, a difference between a number of peers of the endpoint and a number of peers of said each peer;
• determining if the endpoint is a service based on the difference determined for each peer of the set of peers;
• performing network management based on the determination of whether the endpoint is a service.