Using graph-based models to identify datacenter anomalies
First Claim
Patent Images
1. A system, comprising:
- a processor configured to;
monitor activities within a network environment and generate a graph of physical connection information, wherein generating the graph of physical connection information includes matching information provided by a client and a server, respectively, into an established connection between the client and the server;
use at least a portion of the generated graph of physical connection information to generate a multidimensional logical graph model, wherein the multidimensional logical graph model comprises a set of nodes and a set of edges, wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type, wherein an edge connects the first node and the second node, wherein a first edge between the first node and the second node has a first edge type and a second edge between the second node and a third node has a second edge type that is different from the first edge type, wherein the first edge type indicates a first behavioral relationship between arbitrary nodes interconnected by the first edge type, and wherein the second edge type indicates a different behavioral relationship between arbitrary nodes interconnected by the second edge type;
determine, using the generated multidimensional logical graph model, that a new edge has been added to the set of edges; and
in response to determining that the new edge has been added to the set of edges, automatically generate an alert that an anomaly in the network environment associated with the new edge has occurred; and
a memory coupled to the processor and configured to provide the processor with instructions.
1 Assignment
0 Petitions
Accused Products
Abstract
Activities within a network environment are monitored (e.g., using agents). At least a portion of the monitored activities are used to generate a logical graph model. The generated logical graph model is used to determine an anomaly. The detected anomaly is recorded and can be used to generate an alert.
-
Citations
31 Claims
-
1. A system, comprising:
-
a processor configured to; monitor activities within a network environment and generate a graph of physical connection information, wherein generating the graph of physical connection information includes matching information provided by a client and a server, respectively, into an established connection between the client and the server; use at least a portion of the generated graph of physical connection information to generate a multidimensional logical graph model, wherein the multidimensional logical graph model comprises a set of nodes and a set of edges, wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type, wherein an edge connects the first node and the second node, wherein a first edge between the first node and the second node has a first edge type and a second edge between the second node and a third node has a second edge type that is different from the first edge type, wherein the first edge type indicates a first behavioral relationship between arbitrary nodes interconnected by the first edge type, and wherein the second edge type indicates a different behavioral relationship between arbitrary nodes interconnected by the second edge type; determine, using the generated multidimensional logical graph model, that a new edge has been added to the set of edges; and in response to determining that the new edge has been added to the set of edges, automatically generate an alert that an anomaly in the network environment associated with the new edge has occurred; and a memory coupled to the processor and configured to provide the processor with instructions. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
-
16. A method, comprising:
-
monitoring activities within a network environment and generating a graph of physical connection information, wherein generating the graph of physical connection information includes matching information provided by a client and a server, respectively, into an established connection between the client and the server; using at least a portion of the generated graph of physical connection information to generate a multidimensional logical graph model, wherein the multidimensional logical graph model comprises a set of nodes and a set of edges, wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type, wherein an edge connects the first node and the second node, wherein a first edge between the first node and the second node has a first edge type and a second edge between the second node and a third node has a second edge type that is different from the first edge type, wherein the first edge type indicates a first behavioral relationship between arbitrary nodes interconnected by the first edge type, and wherein the second edge type indicates a different behavioral relationship between arbitrary nodes interconnected by the second edge type; determining, using the generated multidimensional logical graph model, that a new edge has been added to the set of edges; and in response to determining that the new edge has been added to the set of edges, automatically generating an alert that an anomaly in the network environment associated with the new edge has occurred. - View Dependent Claims (17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30)
-
-
31. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
-
monitoring activities within a network environment and generating a graph of physical connection information, wherein generating the graph of physical connection information includes matching information provided by a client and a server, respectively, into an established connection between the client and the server; using at least a portion of the generated graph of physical connection information to generate a multidimensional logical graph model, wherein the multidimensional logical graph model comprises a set of nodes and a set of edges, wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type, wherein an edge connects the first node and the second node, wherein a first edge between the first node and the second node has a first edge type and a second edge between the second node and a third node has a second edge type that is different from the first edge type, wherein the first edge type indicates a first behavioral relationship between arbitrary nodes interconnected by the first edge type, and wherein the second edge type indicates a different behavioral relationship between arbitrary nodes interconnected by the second edge type; determining, using the generated multidimensional logical graph model, that a new edge has been added to the set of edges; and in response to determining that the new edge has been added to the set of edges, automatically generating an alert that an anomaly in the network environment associated with the new edge has occurred.
-
Specification