Methods and systems for application session modeling and prediction of granular bandwidth requirements

• US 10,560,314 B2
• Filed: 09/16/2015
• Issued: 02/11/2020
• Est. Priority Date: 09/16/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Cloudgenix, Inc. (Palo Alto Networks Incorporated)
• Inventors: Ramachandran, Kumar, Anand, Venkataraman, Yadav, Navneet, Ramasamy, Arivu, Valentini, Giorgio, Sagar, Vijay
• Primary Examiner(s): Christensen, Scott B
• Application Number:
  US14/856,429
• Publication Number:
  US 20160080252A1
• Time in Patent Office: 1,609 Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 : based on throughput or bandwidth
• CPC Class Codes: H04L 45/22 : Alternate routing
• CPC Class Codes: H04L 45/28 : using route fault recovery
• CPC Class Codes: H04L 45/302 : Route determination based on requested QoS
• CPC Class Codes: H04L 45/306 : Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 : Flow based routing
• CPC Class Codes: H04L 47/125 : by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/22 : Traffic shaping
• CPC Class Codes: H04L 47/24 : Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/32 : by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 47/781 : Centralised allocation of resources
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 : using domain name system [DNS]
• CPC Class Codes: H04L 61/4523 : using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks

Abstract

A method includes receiving from a networked spoke device information describing network flows to and from an application, analyzing the information to characterize the application in at least one dimension selected from the group consisting of bi-directional bandwidth usage, network response times, application response times, a number of idle and active application sessions and a maximum number of concurrent application sessions and transmitting the dimensions to at least one networked spoke device as traffic profile information.

Claims

1. A method comprising:

receiving, by a multi-tenant controller, from a networked spoke device, information describing network flows to and from each of a plurality of applications, wherein each application of the plurality of applications has respective network flows by a respective group of users of an enterprise at a specific site;

analyzing, by a multi-tenant controller, the information to characterize each application, wherein each application is characterized for the specific site by type as one of a real-time application, a transactional application, or a file transfer application;

updating, based on the analyzing, different traffic profiles with respect to each respective group of users, wherein each updated traffic profile further includes a corresponding bi-directional bandwidth usage for each of the characterized types of traffic;

assigning, based on the updated traffic profiles, a corresponding business priority for each application according to the characterized application types including for a real-time application, a transactional application, and a file transfer application;

transmitting the updated application traffic profile and business priorities to at least one networked spoke device;

determining a type of data traffic to and from each characterized application at the spoke device and predicting a corresponding bi-directional bandwidth usage for the determined type of data traffic using a respective application traffic profile of the updated traffic profiles; and

routing flows, by the spoke device, on the network to and from the characterized application based, at least in part, on the respective application traffic profile and using the predicted bi-directional bandwidth usage along with the corresponding assigned business priority for each of the different application types, including a real-time application, a transactional application, and a file transfer application.

2. The method of claim 1, wherein the traffic profile information describes L4 level network flows.

3. The method of claim 1, wherein the analyzing is performed on a per application session basis.

4. The method of claim 1, further comprising routing the application flows on the network based, at least in part, on a dynamic and automated QoS definition.

5. The method of claim 1, further comprising employing modeling and analytics selected from the group consisting of Pareto and Weibull.

6. The method of claim 1, further comprising utilizing parameters to categorize the application network flows.

7. A centrally controllable multi-tenant controller for controlling a plurality of assets across a plurality of distributed computing environments, wherein the controller is configured to:

receive, from a networked spoke device, information describing network flows to and from each of a plurality of applications, wherein each application of the plurality of applications has respective network flows by a respective group of users of an enterprise at a specific site;

analyze the information to characterize each application, wherein each application is characterized for the specific site by type as one of a real-time application, a transactional application, or a file transfer application;

update, based on the analysis, different traffic profiles with respect to each respective group of users, wherein each updated traffic profile further includes a corresponding bi-directional bandwidth usage for each of the characterized types of traffic;

assign, based on the updated traffic profiles a corresponding business priority for each application according to the characterized application types, including for a real-time application, a transactional application, and a file transfer application;

transmit the updated application traffic profile and business priorities to a networked spoke device as traffic profile information;

determine a type of data traffic to and from each characterized application at the spoke device and predict a corresponding bi-directional bandwidth usage for the determined type of data traffic using a respective application traffic profile of the updated traffic profiles; and

wherein the spoke device is enabled to route flows on the network to and from the characterized application based, at least in part, on the respective application traffic profile and using the predicted bi-directional bandwidth usage along with the corresponding assigned business priority for each of the different application types, including a real-time application, a transactional application, and a file transfer application.

8. The centrally controllable multi-tenant controller of claim 7, wherein the traffic profile information describes L4 level network flows.

9. The centrally controllable multi-tenant controller of claim 7, wherein the analyzing is performed on a per application session basis.

10. The centrally controllable multi-tenant controller of claim 7, further configured to route the network flows based, at least in part, on a dynamic and automated QoS definition.

11. The centrally controllable multi-tenant controller of claim 7, further configured to employ modeling and analytics selected from the group consisting of Pareto and Weibull.

12. The centrally controllable multi-tenant controller of claim 7, further configured to utilize parameters to categorize network flows.