# US 2026/0074972 A1 · Optimized Container-Based Network Intelligence > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0074972 A1 - Document ID: US20260074972A1 - Status: Published application - Kind: A1 - Application number: 19/058,786 - Filed: 2025-02-20 - Published: 2026-03-12 - Earliest claimed: 2024-09-11 - Assignees: CAST AI Group, Inc. - Applicants: CAST AI Group, Inc. - Inventors: Andžej Maciusovic - Web page: https://patentgrep.com/patent/US20260074972A1 ## CPC - H04L 43/062: related to network traffic - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 43/026: using flow identification - H04L 43/045: for graphical visualisation of monitoring data - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system or method for optimizing network intelligence. An agent is deployed onto each node in a cloud environment. Each agent is executed within the kernel of its corresponding node and is attached to network-related system calls in the kernel. For each node, the agent monitors network-related system calls to observe incoming and outgoing network traffic and determines metrics associated with the network traffic based on the monitored network-related system calls. The system also identifies process-level network traffic flows based on the received metrics and a topology of the plurality of nodes in the cloud environment. The system classifies each of the process-level network flows into intra-zone or cross-zone based on traffic being local or external to a zone and generates and presents a graph for display corresponding to the process-level network traffic. ## Claims ### Claim 1 A method, comprising: deploying a plurality of agents in a cloud environment, wherein each agent of the plurality of agent is deployed onto a different node of a plurality of nodes, and wherein each agent of the plurality of agents is: executed in a kernel of a node on which the agent is deployed, attached to network-related system calls in the kernel in which the network-related system calls are executed, and configured to monitor data associated with network traffic flows that originate from or received by the node and determine metrics associated with network traffic flows on the node based on the monitored data; receiving, from each of the plurality of nodes, respective metrics associated with network traffic flows on the node determined by the agent deployed on the node; identifying process-level network traffic flows based on the received metrics associated with network traffic flows and a topology of the plurality of the nodes in the cloud environment; classifying each of the process-level network flows into intra-zone or cross zone based on traffic being local or external to a zone; generating a graph based on the identified process-level network traffic flows, the graph including a plurality of vertices representing source or destination processes running on the plurality of nodes, and edges linking the vertices representing process-level network traffic flows, wherein the graph corresponds to the topology of the plurality of nodes, and the edges are annotated to indicate whether the corresponding traffic flows between nodes are intra-zone or cross-zone; and presenting the graph for display at a client device. ### Claim 2 (depends on 1) The method of claim 1, wherein the metrics associated with network traffic flows include one or more of packet volumes, packet retransmissions, packet drops, and latencies. ### Claim 3 (depends on 1) The method of claim 1, wherein the agent is attached to the network-related system calls in the kernel using eBPF (extended Berkeley Packet Filter) hooks. ### Claim 4 (depends on 1) The method of claim 1, further comprising determining a topology of the plurality of nodes in the cloud environment based on metadata associated with the plurality of nodes, the metadata associated with the plurality of nodes includes one or more of: node names, IP addresses, ports, regions, and zones associated with the plurality of nodes. ### Claim 5 (depends on 4) The method of claim 4, further comprising identifying a plurality of levels of network traffic flows, including one or more of container-level traffic flows, pod-level traffic flows, node-level traffic flows, and zone-level traffic flows. ### Claim 6 (depends on 1) The method of claim 1, wherein the graph is dynamically updated in response to changes in the network traffic flows, including an addition of a new flow or termination of an existing flow. ### Claim 7 (depends on 1) The method of claim 1, further comprising determining one or more network traffic metrics for each edge in the graph, wherein the one or more network traffic metrics include volume, bandwidth usage, latency, and packet loss associated with the corresponding process-level network traffic flow, and the edges of the graph is further annotated with the one or more network traffic metrics. ### Claim 8 (depends on 7) The method of claim 7, the method further comprising: identifying a first container in a first node associated with a first latency greater than a first predetermined threshold; identifying a second container in a second node associated with a second latency lower than a second predetermined threshold; and migrating the first container in the first node to the second node. ### Claim 9 (depends on 7) The method of claim 7, further comprising: responsive to determining that a volume of a cross-zone network traffic flow between a first node in a first zone and a second node in a second zone is greater than a threshold, migrating a container associated with the cross-zone process-level network traffic flow currently running in the first node in the first zone to the second node in the second zone. ### Claim 10 (depends on 7) The method of claim 7, further comprising: determining that a bandwidth usage associated with a node is greater than a predetermined threshold; and automatically provisioning one or more additional nodes, distributing workload in the node to the one or more additional nodes. ### Claim 11 A non-transitory computer readable storage medium having instructions encoded thereon that, when executed by one or more processors, cause the one or more processors to perform steps comprising: deploying a plurality of agents in a cloud environment, wherein each agent of the plurality of agent is deployed onto a different node of a plurality of nodes, and wherein each agent of the plurality of agents is: executed in a kernel of a node on which the agent is deployed, attached to network-related system calls in the kernel in which the network-related system calls are executed, and configured to monitor data associated with network traffic flows that originate from or received by the node and determine metrics associated with network traffic flows on the node based on the monitored data; receiving, from each of the plurality of nodes, respective metrics associated with network traffic flows on the node determined by the agent deployed on the node; identifying process-level network traffic flows based on the received metrics associated with network traffic flows and a topology of the plurality of the nodes in the cloud environment; classifying each of the process-level network flows into intra-zone or cross zone based on traffic being local or external to a zone; generating a graph based on the identified process-level network traffic flows, the graph including a plurality of vertices representing source or destination processes running on the plurality of nodes, and edges linking the vertices representing process-level network traffic flows, wherein the graph corresponds to the topology of the plurality of nodes, and the edges are annotated to indicate whether the corresponding traffic flows between nodes are intra-zone or cross-zone; and presenting the graph for display at a client device. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the metrics associated with network traffic flows include one or more of packet volumes, packet retransmissions, packet drops, and latencies. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the agent is attached to the network-related system calls in the kernel using eBPF (extended Berkeley Packet Filter) hooks. ### Claim 14 (depends on 11) The non-transitory computer readable storage medium of claim 11, the steps further comprising identifying a plurality of levels of network traffic flows, including one or more of container-level traffic flows, pod-level traffic flows, node-level traffic flows, and zone-level traffic flows. ### Claim 15 (depends on 11) The non-transitory computer readable storage medium of claim 11, further comprising determining a topology of the plurality of nodes in the cloud environment based on metadata associated with the plurality of nodes, the metadata associated with the plurality of nodes includes one or more of: node names, IP addresses, ports, regions, and zones associated with the plurality of nodes. ### Claim 16 (depends on 11) The non-transitory computer readable storage medium of claim 11, the steps further comprising determining one or more network traffic metrics for each edge in the graph, wherein the one or more network traffic metrics include volume, bandwidth usage, latency, and packet loss associated with the corresponding process-level network traffic flow, and the edges of the graph is further annotated with the one or more network traffic metrics. ### Claim 17 (depends on 16) The non-transitory computer readable storage medium of claim 16, the steps further comprising: identifying a first container in a first node associated with a first latency greater than a first predetermined threshold; identifying a second container in a second node associated with a second latency lower than a second predetermined threshold; and migrating the first container in the first node to the second node. ### Claim 18 (depends on 16) The non-transitory computer readable storage medium of claim 16, the steps further comprising: responsive to determining that a volume of a cross-zone network traffic flow between a first node in a first zone and a second node in a second zone is greater than a threshold, migrating a container associated with the cross-zone process-level network traffic flow currently running in the first node in the first zone to the second node in the second zone. ### Claim 19 (depends on 16) The non-transitory computer readable storage medium of claim 16, the steps further comprising: determining that a bandwidth usage associated with a node is greater than a predetermined threshold; and automatically provisioning one or more additional nodes, distributing workload in the node to the one or more additional nodes. ### Claim 20 A system, comprising: one or more processors; and a non-transitory computer readable storage medium having instructions encoded thereon that, when executed by the one or more processors, cause the one or more processors to perform steps comprising: deploying a plurality of agents in a cloud environment, wherein each agent of the plurality of agent is deployed onto a different node of a plurality of nodes, and wherein each agent of the plurality of agents is: executed in a kernel of a node on which the agent is deployed, attached to network-related system calls in the kernel in which the network-related system calls are executed, and configured to monitor data associated with network traffic flows that originate from or received by the node and determine metrics associated with network traffic flows on the node based on the monitored data; receiving, from each of the plurality of nodes, respective metrics associated with network traffic flows on the node determined by the agent deployed on the node; identifying process-level network traffic flows based on the received metrics associated with network traffic flows and a topology of the plurality of the nodes in the cloud environment; classifying each of the process-level network flows into intra-zone or cross zone based on traffic being local or external to a zone; generating a graph based on the identified process-level network traffic flows, the graph including a plurality of vertices representing source or destination processes running on the plurality of nodes, and edges linking the vertices representing process-level network traffic flows, wherein the graph corresponds to the topology of the plurality of nodes, and the edges are annotated to indicate whether the corresponding traffic flows between nodes are intra-zone or cross-zone; and presenting the graph for display at a client device.