Visualizing network activity involving networked computing devices distributed across network address spaces

• US 10,594,576 B2
• Filed: 01/31/2017
• Issued: 03/17/2020
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Cavuto, David J., Shcherbakov, Vladimir A., Mak, Joshua H., Hsiao, Fang I.
• Primary Examiner(s): Khan, Aftab N.
• Application Number:
  US15/421,389
• Publication Number:
  US 20180219751A1
• Time in Patent Office: 1,141 Days
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

Techniques and mechanisms are disclosed for generating visualizations which graphically depict network activity occurring between pairs of networked computing devices. The visualizations are based on data indicating the network activity, where the network activity can involve devices having any network addresses within an entire network address space (e.g., any address within the Internet Protocol version v4 (IPv4) or IPv6 network address space), or within some subset of an entire network address space. The ability to visualize high-level information related to network activity occurring across an entire network address space enables network analysts and other users to readily analyze characteristics of computer networks which otherwise might not be evident or difficult to obtain using other types of visualizations.

Claims

1. A computer-implemented method, comprising:

receiving a request to cause display of a graphical user interface (GUI) including a network activity visualization, the network activity visualization displaying a representation of network activity involving pairs of networked devices, wherein at least one networked device of each pair of networked devices is one of a plurality of networked devices in a monitored information technology (IT) environment;

identifying, based on collected network activity data related to the IT environment, instances of network activity between the pairs of networked devices; and

causing display of the GUI including the network activity visualization, the network activity visualization including a graph, the graph including;

a first axis representing a range of source network addresses in an address space,

a second axis representing a range of destination network addresses in the address space, wherein the range of source network addresses represented by the first axis and the range of destination network addresses represented by the second axis includes an entire network address space, and wherein the entire network address space is one of;

the Internet Protocol version 4 (IPv4) network address space or the Internet Protocol version 6 (IPv6) network address space, and

a plurality of data points plotted on the graph relative to the first axis and the second axis, each data point of the plurality of data points representing;

a subrange of the range of source network addresses and a subrange of the range of destination network addresses, and

at least one instance of network activity, the at least one instance of network activity associated with a source networked device having a source network address within the subrange of the range of source network addresses, and a destination networked device having a destination network address within the subrange of the range of destination network addresses.

2. The method of claim 1, wherein a location of each data point of the plurality of data points corresponds to the range of source network addresses and the range of destination network addresses represented by the data point.

3. The method of claim 1, wherein the subrange of the range of source network addresses corresponds to network addresses having a same first two bytes of an Internet Protocol (IP) address, and wherein the subrange of the range of destination network addresses corresponds to network addresses having a same first two bytes of an IP address.

4. The method of claim 1, wherein the range of source network addresses is the same size as the range of destination network addresses.

5. The method of claim 1, wherein the range of source network addresses is a different size from the range of destination network addresses.

6. The method of claim 1, wherein at least one of the instances of network activity corresponds to one or more of:

a network session involving a pair of networked computing devices, a network flow involving a pair of networked computing devices, and a network connection involving a pair of networked computing devices.

7. The method of claim 1, wherein each data point of the plurality of data points is displayed as a shape having an area corresponding to a number of instances of network activity represented by the data point.

8. The method of claim 1, wherein each data point of the plurality of data points is displayed as a shape having an area corresponding to a value associated with instances of network activity represented by the data point.

9. The method of claim 1, wherein each data point of the plurality of data points is displayed as a shape having an area corresponding to at least one value associated with instances of network activity represented by the data point, wherein the at least one value includes one or more of:

a number of packets transferred, an amount of data transferred, a duration of time, and a data transfer rate.

10. The method of claim 1, further comprising:

receiving a selection of at least one characteristic of the instances of network activity, the at least one characteristic including one or more;

a quantity of instances of network activity, a number of packets transferred, an amount of data transferred, a duration of time, and a data transfer rate; and

updating the display of the plurality of data points based on the at least one characteristic.

11. The method of claim 1, wherein the range of source network addresses represented by the first axis and the range of destination network addresses represented by the second axis includes an entire network address space.

12. The computer-implemented method of claim 1, wherein each data point is displayed with a variable characteristic relative to an age of the instances of network activity associated with the data point, and wherein the variable characteristic is one or more of:

opacity, color, area, shape, and color intensity.

13. The computer-implemented method of claim 1, wherein the network activity data includes log data, and wherein at least one of the instances of network activity corresponds to one or more log entries of the log data.

14. The computer-implemented method of claim 1, wherein the network activity data includes timestamped event data, the timestamped event data generated by a network component monitoring network traffic traversing a computer network.

15. The method of claim 1, wherein the graph is a bubble chart, and wherein each data point of the plurality of data points is displayed as a bubble having an area corresponding to at least one characteristic of the instances of network activity represented by the data point.

16. The method of claim 1, further comprising causing display of an animated series of data points, wherein each instance of the animated series of data points is displayed in a chronological order based on timestamps associated with instances of network activity represented by the data points.

17. The method of claim 1, further comprising:

receiving input indicating a range of time associated with the instances of network activity; and

causing display of an animated series of data points, wherein the animated series of data points is based on instances of network activity associated with timestamps within the indicated range of time, and wherein each instance of the animated series of data points is displayed in a chronological order based on the timestamps associated with the instances of network activity.

18. The method of claim 1, further comprising:

causing display of an animated series of data points, wherein each instance of the animated series of data points is displayed in a chronological order based on timestamps associated with instances of network activity represented by the data points;

receiving input indicating a request to temporally scan the animated series of data points, wherein temporally scanning the animated series of data points includes one or more of;

rewinding, fast-forwarding, pausing, and restarting; and

causing display of the animated series of data points according to the input.

19. The method of claim 1, further comprising:

wherein the GUI includes a timeline interface element including a selectable range of time associated with the instances of network activity;

receiving, via the timeline interface element, a selection of a time segment from the range of time; and

based on the selected time segment, causing display of data points associated with the selected time segment.

20. The method of claim 1, wherein the range of source network addresses and the range of destination network addresses are each defined by a portion of a network address.

21. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

receiving a request to cause display of a graphical user interface (GUI) including a network activity visualization, the network activity visualization displaying a representation of network activity involving pairs of networked devices, wherein at least one networked device of each pair of networked devices is one of a plurality of networked devices in a monitored information technology (IT) environment;

identifying, based on collected network activity data related to the IT environment, instances of network activity between the pairs of networked devices; and

causing display of the GUI including the network activity visualization, the network activity visualization including a graph, the graph including;

a first axis representing a range of source network addresses in an address space,

a second axis representing a range of destination network addresses in the address space, wherein the range of source network addresses represented by the first axis and the range of destination network addresses represented by the second axis includes an entire network address space, and wherein the entire network address space is one of;

the Internet Protocol version 4 (IPv4) network address space or the Internet Protocol version 6 (IPv6) network address space, and

a plurality of data points plotted on the graph relative to the first axis and the second axis, each data point of the plurality of data points representing;

a subrange of the range of source network addresses and a subrange of the range of destination network addresses, and

at least one instance of network activity, the at least one instance of network activity associated with a source networked device having a source network address within the subrange of the range of source network addresses, and a destination networked device having a destination network address within the subrange of the range of destination network addresses.

22. The non-transitory computer-readable storage medium of claim 21, wherein a location of each data point of the plurality of data points corresponds to the range of source network addresses and the range of destination network addresses represented by the data point.

23. The non-transitory computer-readable storage medium of claim 21, wherein the subrange of the range of source network addresses and the subrange of the range of destination network addresses are each defined by a portion of a network address.

24. The non-transitory computer-readable storage medium of claim 21, wherein at least one of the instances of network activity corresponds to one or more of:

a network session involving a pair of networked computing devices, a network flow involving a pair of networked computing devices, and a network connection involving a pair of networked computing devices.

25. An apparatus, comprising:

one or more processors;

a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to;

receive a request to cause display of a graphical user interface (GUI) including a network activity visualization, the network activity visualization displaying a representation of network activity involving pairs of networked devices, wherein at least one networked device of each pair of networked devices is one of a plurality of networked devices in a monitored information technology (IT) environment;

identify, based on collected network activity data related to the IT environment, instances of network activity between the pairs of networked devices; and

cause display of the GUI including the network activity visualization, the network activity visualization including a graph, the graph including;

a first axis representing a range of source network addresses in an address space,

a second axis representing a range of destination network addresses in the address space, wherein the range of source network addresses represented by the first axis and the range of destination network addresses represented by the second axis includes an entire network address space, and wherein the entire network address space is one of;

the Internet Protocol version 4 (IPv4) network address space or the Internet Protocol version 6 (IPv6) network address space, and

plurality of data points plotted on the graph relative to the first axis and the second axis, each data point of the plurality of data points representing;

a subrange of the range of source network addresses and a subrange of the range of destination network addresses, and

at least one instance of network activity, the at least one instance of network activity associated with a source networked device having a source network address within the subrange of the range of source network addresses, and a destination networked device having a destination network address within the subrange of the range of destination network addresses.

26. The apparatus of claim 25, wherein a location of each data point of the plurality of data points corresponds to the range of source network addresses and the range of destination network addresses represented by the data point.

27. The apparatus of claim 25, wherein the subrange of the range of source network addresses and the subrange of the range of destination network addresses are each defined by a portion of a network address.

28. The apparatus of claim 25, wherein at least one of the instances of network activity corresponds to one or more of:

a network session involving a pair of networked computing devices, a network flow involving a pair of networked computing devices, and a network connection involving a pair of networked computing devices.