US 2020/0267169 A1Published application

Network Monitoring, Detection, and Analysis System

AssigneeKentik Technologies, Inc.

InventorsAvraham Tzur Freedman, Ian Gerald Pye, Daniel P. Ellis, Ian Applegate

Life of this patent

Estimating the term…

Loading patent…

Abstract

The Kentik Data Engine (KDE) is an integrated real-time, big data software system able to analyze what exactly is happening on a network at the present moment, and what happened on the network over the a prior period of time. KDE collects live operational data from computer network infrastructure devices (routers and switches) and computer hosts, consisting of multiple data types, categories, and protocols, and correlates them to analyze network activity and health. KDE does this in a lossless manner, meaning that it retains all raw data rather than summarizing or aggregating prior to storage. In this way, KDE provides a combination of precise, actionable information in real-time as well as a complete forensic data store for detailed exploratory analysis.

Claims20

Dependent claims

A method for network monitoring, comprising:

receiving network flow data represented as a plurality of data records describing operational data for a device in a computer network;
ingesting the received network flow data for storage within a plurality of data servers, by:
identifying a subset of the plurality of data servers for storing data records for the device;
forwarding the data records for the device to the identified subset of the plurality of data servers;
recording metadata describing which data servers of the plurality of data servers are in the subset storing the data records for the device;
responsive to receiving a query for at least a portion of the data records for the device:
identifying, using the recorded metadata, which data servers of the plurality of data servers are in the subset storing the data records for the device;
transmitting the query to at least one of the identified data servers storing the data records for the device;
and
receiving the data records for the device from the at least one of the identified data servers.

7 more elements

A system for network monitoring, comprising:

a plurality of ingest servers configured to:
receive network flow data represented as a plurality of data records describing operational data for a device in a computer network;
identify a subset of a plurality of data servers for storing data records for the device;
forward the data records for the device to the identified subset of the plurality of data servers;
a metadata system configured to record metadata describing which data servers of the plurality of data servers are in the subset storing the data records for the device;
a query processor configured to:
receive a query for at least a portion of the data records for the device;
responsive to receiving the query, identify, using the recorded metadata, which data servers of the plurality of data servers are in the subset storing the data records for the device;
transmit the query to at least one of the identified data servers that are storing the data records for the device;
and
receive the data records for the device from the at least one of the identified data servers.

8 more elements

A computer program product for performing network monitoring, the computer program product comprising a computer-readable storage medium containing computer program code that when executed causes one or more processors to perform:

receiving network flow data represented as a plurality of data records describing operational data for a device in a computer network;
ingesting the received network flow data for storage within a plurality of data servers, by:
identifying a subset of the plurality of data servers for storing data records for the device;
forwarding the data records for the device to the identified subset of the plurality of data servers;
recording metadata describing which data servers of the plurality of data servers are in the subset storing the data records for the device;
responsive to receiving a query for at least a portion of the data records for the device:
identifying, using the recorded metadata, which data servers of the plurality of data servers are in the subset storing the data records for the device;
transmitting the query to at least one of the identified data servers storing the data records for the device;
and
receiving the data records for the device from the at least one of the identified data servers.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/869,163Filed 7 May 2020
Priority: 15 Jan 2016
Published: 20 Aug 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification17 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 16/2379
Updating: updates performed during online database operations; commit processing
G06F 16/24565
Applying rules; Deductive queries: triggers; Constraints
G06F 16/24568
Query execution: data stream processing; Continuous queries

Family

Application62/279,573Us provisional application · filed 15 Jan 2016
Application15/404,623Continuation · filed 12 Jan 2017
Application15/895,740Continuation · filed 13 Feb 2018
Application16/869,163Continuation
US 10,681,065 B2Related patent
US 11,330,002 B2Related patent
US 2017/0208077 A1Published application
US 2018/0176237 A1Published application
US 9,942,253 B2Related patent
US 2020/0267169 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key