Network traffic analysis using a dynamically updating ontological network description

A system for network traffic analysis, said system comprising:

• a memory;
• a processor, coupled to the memory;
• and
• an application server, executed from the memory by the processor, wherein the application server is to:
• deploy, across a network comprising a plurality of network nodes, at least one data collection agent, on at least two of said plurality of network nodes, each said data collection agent monitoring, at a respective network node, a plurality of network connections instantiated during a monitoring time period, wherein each data collection agent is inserted at the respective network node to interface with multiple locations of a network stack of an operating system of the respective network node to track each of the plurality of network connections associated with the respective network node;
• acquire data from each data collection agent, said data resulting from said monitoring;
• create an ontological description of the network using the acquired data, the ontological description of the network comprising the plurality of network nodes and current connections of the plurality of network nodes;
• update said ontological description based on data subsequently acquired by each data collection agent at each network node;
• and
• create a visualization of said ontological description for analyzing network traffic using the updated ontological description.

A non-transitory computer readable medium having instructions that, when executed by a processing device, cause the processing device to perform a method for network traffic analysis, said method comprising:

• deploying, across a network comprising a plurality of network nodes, at least one data collection agent, on at least two of said plurality of network nodes;
• monitoring, with each data collection agent at a respective network node, a plurality of network connections instantiated during a monitoring time period for said respective network node, wherein each data collection agent is inserted at the respective network node to interface with multiple locations of a network stack of an operating system of the respective network node to track each of the plurality of network connections associated with the respective network node;
• acquiring data from each data collection agent, said data resulting from said monitoring;
• creating an ontological description of the network using the acquired data, the ontological description of the network comprising the plurality of network nodes and current connections of the plurality of network nodes;
• updating said ontological description based on data subsequently acquired by each data collection agent at each network node;
• and
• analyzing network traffic using the updated ontological description.