# US 2022/0286408 A1 · Systems and methods for intelligent application grouping > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0286408 A1 - Document ID: US20220286408A1 - Status: Published application - Kind: A1 - Application number: 17/586,051 - Filed: 2022-01-27 - Published: 2022-09-08 - Earliest claimed: 2015-09-06 - Assignees: RISC Networks, LLC - Applicants: RISC Networks, LLC - Inventors: Jeremy Littlejohn; Greg Watts - Web page: https://patentgrep.com/patent/US20220286408A1 ## CPC - H04L 43/12: Network monitoring probes - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/062: related to network traffic - H04L 47/803: {Application aware} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 69/32: Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is described that comprises collecting communication data travelling among a plurality of computing nodes in a networked environment. The method includes using the communication data to create a plurality of connectivity records, wherein each connectivity record comprises a communication between a source computing node and a destination computing node of the plurality of computing nodes. The method includes associating the communication with an application context and protocol. The method includes processing the plurality of connectivity records to eliminate connectivity records that meet at least one criteria, wherein the plurality of connectivity records includes associated application contexts and protocols, wherein a first portion of the plurality of connectivity records comprises the eliminated connectivity records, wherein a second portion of the plurality of connectivity records comprises the remainder of the connectivity records. The method includes building a graph using the second portion of the connectivity records. ## Claims ### Claim at position 1 1-42. (canceled) ### Claim 43 A computer-implemented method comprising: under control of a computing system comprising one or more computing devices configured to execute specific instructions, collecting communication data regarding communications among a plurality of computing nodes in a networked environment; creating a plurality of connectivity records from the communication data, wherein each connectivity record of the plurality of connectivity records represents a communication between a source computing node and a destination computing node of the plurality of computing nodes; identifying a plurality of applications of the networked environment based at least partly on device types for individual computing nodes associated with the plurality of connectivity records; and generating a graph of the networked environment based at least partly on the identifying the plurality of applications, wherein the graph comprises a plurality of vertices corresponding to the plurality of applications. ### Claim 44 (depends on 43) The computer-implemented method of claim 43, further comprising: generating cross-reference data based on the plurality of connectivity records cross-referenced with service oriented architecture group membership information for corresponding computing nodes associated with the plurality of connectivity records; and determining device types for the corresponding computing nodes associated with the plurality of connectivity records based at least partly on the cross-reference data. ### Claim 45 (depends on 43) The computer-implemented method of claim 43, wherein creating the plurality of connectivity records from the communication data comprises creating the plurality of connectivity records from portions of the communication data that satisfy a criterion. ### Claim 46 (depends on 43) The computer-implemented method of claim 43, wherein generating the graph comprises including, in the graph, a plurality of edges representing communication links between applications. ### Claim 47 (depends on 46) The computer-implemented method of claim 46, wherein generating the graph comprises including, in the graph, an edge that designates whether a communication link is critical or non-critical. ### Claim 48 (depends on 46) The computer-implemented method of claim 46, wherein generating the graph comprises including, in the graph, an edge that designates whether an application is licensed or unlicensed. ### Claim 49 (depends on 43) The computer-implemented method of claim 43, wherein creating the plurality of connectivity records from the communication data comprises creating a first connectivity record using a first communication which comprises a source IP address of a first source computing node and a destination IP address of a first destination computing node. ### Claim 50 (depends on 49) The computer-implemented method of claim 49, further comprising associating the first communication with an application context. ### Claim 51 (depends on 50) The computer-implemented method of claim 50, further comprising associating the first communication with a protocol. ### Claim 52 (depends on 43) The computer-implemented method of claim 43, further comprising determining to exclude a service orientated architecture application from a set of applications represented by vertices of the graph. ### Claim 53 A system comprising: computer-readable memory storing executable instructions; and one or more processors in communication with the computer-readable memory and configured by the executable instructions to at least: collect communication data regarding communications among a plurality of computing nodes in a networked environment; create a plurality of connectivity records from the communication data, wherein each connectivity record of the plurality of connectivity records represents a communication between a source computing node and a destination computing node of the plurality of computing nodes; identify a plurality of applications of the networked environment based at least partly on device types for individual computing nodes associated with the plurality of connectivity records; and generate a graph of the networked environment in response to identifying the plurality of applications, wherein the graph comprises a plurality of vertices corresponding to the plurality of applications. ### Claim 54 (depends on 53) The system of claim 53, wherein the one or more processors are further configured by executable instructions to at least: generate cross-reference data based on the plurality of connectivity records cross-referenced with service oriented architecture group membership information for corresponding computing nodes associated with the plurality of connectivity records; and determine device types for the corresponding computing nodes associated with the plurality of connectivity records based at least partly on the cross-reference data. ### Claim 55 (depends on 53) The system of claim 53, wherein to create the plurality of connectivity records from the communication data, the one or more processors are further configured by the executable instructions to create the plurality of connectivity records from portions of the communication data that satisfy a criterion. ### Claim 56 (depends on 53) The system of claim 53, wherein the graph comprises a plurality of edges representing communication links between applications. ### Claim 57 (depends on 56) The system of claim 56, wherein the graph comprises an edge that designates whether a communication link is critical or non-critical. ### Claim 58 (depends on 56) The system of claim 56, wherein the graph comprises an edge that designates whether an application is licensed or unlicensed. ### Claim 59 (depends on 53) The system of claim 53, wherein to create the plurality of connectivity records from the communication data, the one or more processors are further configured by the executable instructions to create a first connectivity record using a first communication which comprises a source IP address of a first source computing node and a destination IP address of a first destination computing node. ### Claim 60 (depends on 59) The system of claim 59, wherein the one or more processors are further configured by executable instructions to associate the first communication with an application context. ### Claim 61 (depends on 60) The system of claim 60, wherein the one or more processors are further configured by executable instructions to associate the first communication with a protocol. ### Claim 62 (depends on 53) The system of claim 53, wherein the one or more processors are further configured by executable instructions to exclude a service orientated architecture application from a set of applications represented by vertices of the graph.