US 2022/0070073 A1 · CORRELATING CAUSES AND EFFECTS ASSOCIATED WITH NETWORK ACTIVITY

Abstract

Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

Claims20

Dependent claims

A method for monitoring network traffic over one or more networks using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

providing one or more metrics based on network traffic that is associated with a plurality of entities in one or more portions of the one or more networks;
providing one or more activity profiles for the one or more portions of the network traffic;
determining one or more other activity profiles that correlate to the one or more activity profiles based on one or more models;
determining one or more scores for the one or more models based on one or more other portions of network traffic occurring subsequent to the one or more portions of the network traffic;
re-training each model associated with a determined score that is outside a range of values based on the network traffic;
and
providing one or more reports to one or more users.

4 more elements

A processor readable non-transitory storage media that includes instructions for monitoring network traffic over a network using one or more network monitoring computers, wherein execution of the instructions by one or more processors of the one or more network computers performs actions comprising:

providing one or more metrics based on network traffic that is associated with a plurality of entities in one or more portions of the one or more networks;
providing one or more activity profiles for the one or more portions of the network traffic;
determining one or more other activity profiles that correlate to the one or more activity profiles based on one or more models;
determining one or more scores for the one or more models based on one or more other portions of network traffic occurring subsequent to the one or more portions of the network traffic;
re-training each model associated with a determined score that is outside a range of values based on the network traffic;
and
providing one or more reports to one or more users.

4 more elements

Dependencies are inferred from the claim text.

Correlating causes and effects associated with network activity

Life of this patent

Correlating causes and effects associated with network activity

Life of this patent

Abstract

Claims20