Distributed and adaptive computer network analytics

• US 10,305,759 B2
• Filed: 01/05/2015
• Issued: 05/28/2019
• Est. Priority Date: 01/05/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Clemm, Ludwig Alexander, Chandramouli, Yegnanarayanan, Krishnamurthy, Saileshwar
• Primary Examiner(s): Henderson, Esther B.
• Assistant Examiner(s): Mahmud, Golam
• Application Number:
  US14/589,953
• Publication Number:
  US 20160197799A1
• Time in Patent Office: 1,604 Days
• Field of Search: 709202
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A network analytics controller in a computer network receives specification of a network analysis task. The controller creates maplets. Each maplet corresponds to an agent executing on a network node in the computer network. Each maplet specifies the network data collection configuration, collected data processing, and processed data reporting to be performed to support the network analysis task at the node executing the corresponding agent. The controller communicates the maplet corresponding to the agent over the computer network to each agent. Each agent receiving a maplet configures its corresponding network node for network data collection, collected data processing, and processed data reporting in accordance with the received maplet. Each agent receiving a maplet collects and processes network data, and reports the processed data to the controller, in accordance with the configuration. The controller aggregates, as the result of the network analysis task, the data reported from each agent.

Claims

1. A method, comprising:

receiving, by a network analytics controller in a computer network, a specification of a network analysis task;

creating, by the network analytics controller, a plurality of maplets, each maplet;

corresponding to an agent executing on a particular network node in the computer network, and

specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicating, by the network analytics controller over the computer network to each agent executing on a particular network node, the maplet corresponding to the agent;

configuring, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;

collecting network data and processing the collected network data, by each agent receiving a maplet, in accordance with the configuration;

reporting, to the network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;

modifying, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and

aggregating, by the network analytics controller, the data reported from each agent receiving a maplet, as a result of the specified network analysis task.

2. The method of claim 1, wherein the first maplet and the second maplet are the same maplet.

3. The method of claim 1, wherein the first maplet and the second maplet are different maplets.

4. The method of claim 1, wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

5. Logic encoded on one or more non-transitory tangible media for execution and when executed operable to:

receive a specification of a network analysis task in a computer network;

create a plurality of maplets, each maplet;

corresponding to an agent executing on a particular network node in the computer network, and

each maplet specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicate, over the computer network to each agent executing on a particular network node, the maplet corresponding to the agent;

configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;

collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration;

report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;

modify, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and

aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

6. The logic of claim 5, wherein the first maplet and the second maplet are the same maplet.

7. The logic of claim 6, wherein the first maplet and the second maplet are different maplets.

8. The logic of claim 5, wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

9. A system, comprising:

a storage device; and

a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to;

receive a specification of a network analysis task in a computer network;

create a plurality of maplets, each maplet;

corresponding to an agent executing on a particular network node in the computer network; and

specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicate, over the computer network to each particular executing on a particular network node, the maplet corresponding to the particular;

configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;

collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration;

report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration, wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet;

modify, by a first agent corresponding to the first maplet, the configuration of the node corresponding to the first agent for at least one of the network data collection, the collected data processing, and the processed data reporting, in adaptation to the processed data reported in accordance with the second maplet; and

aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

10. The system of claim 9, wherein the first maplet and the second maplet are the same maplet.

11. The system of claim 10, wherein the first maplet and the second maplet are different maplets.

12. The system of claim 9, wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

13. The system of claim 9 wherein:

the application code instructions that cause the system to receive a specification of a network analysis task, create a plurality of maplets to support the specified task, communicate each maplet to a particular, and aggregate the data reported from each agent, are executed by a network analytics controller; and

the application code instructions that cause the system to receive the maplet corresponding to a particular, configure a network node corresponding to the particular agent in accordance with the received maplet, collect network data in accordance with the configuration, process the collected network data in accordance with the configuration, and report the processed network data in accordance with the configuration, are performed at the network node executing the particular.

14. The system of claim 13:

wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet, and

wherein the logic, when executed, is further operable to adapt at least one of the network data collection, collected data processing, and processed data reporting at the network node of the first maplet to and the processed data reported in accordance with the second maplet.

15. The system of claim 14, wherein the first maplet and the second maplet are the same maplet.

16. The system of claim 15, wherein the first maplet and the second maplet are different maplets.

17. The system of claim 13, wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.