Generic discovery for computer networks

• US 20060123104A1
• Filed: 12/06/2005
• Published: 06/08/2006
• Est. Priority Date: 12/06/2004
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Spinelli, Lionel, Chabrier, Jean-Claude, Germain, Pierre
• Granted Patent: US 8,683,032 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A generic discovery methodology collects data pertaining to components of a computer network using various discovery technologies. From the collected data, the methodology identifies, filters and analyzes information related to inter-component communications. Using the communication and application information, the methodology determines reliable relationships for those components having sufficient information available. To qualify more components, the methodology implements a decision service to generate hypothetical relationships between components that are known and components that are unqualified or unknown. The hypothetical relationships are presented to a user for selection, and each hypothetical relationship is preferably associated with an indication of its reliability.

Claims

1. A generic discovery method comprising:

collecting at least partial data pertaining to components of a computer network;

determining communication information and application information from the collected data, the communication information pertaining to at least some communications between components, the application information pertaining to at least some applications of components; and

generating at least one hypothesis of a relationship between applications of at least two components based on communication information and application information.

2. The method of claim 1, wherein the act of collecting comprises obtaining the collected data from a database.

3. The method of claim 1, wherein the act of collecting at least partial data pertaining to components of a computer network comprises exploring the computer network with one or more discovery technologies selected from the group consisting of Secure Shell (SSH), Windows Management Instrumentation (WMI), remote connectivity protocols, Simple Network Management Protocol (SNMP), Transmission Control Protocol (TCP) portscan, Sequential Query Language (SQL), Remote Procedure Call (RPC), and Distributed Computer Environment (DCE).

4. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises filtering collected data to isolate communications that use one or more predefined ports on components.

5. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises filtering collected data to remove communications that use one or more predefined ports on components.

6. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises:

detecting a collection of ports on a first component, and

determining what one or more second components or applications are communicating with the collection of ports on the first component.

7. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises detecting which ports of a first component are used to establish simultaneous connections with a plurality of second components.

8. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises:

detecting which communications of a first component are established between processes of the first component; and

detecting a communication of one of the processes with at least one application of second component; and

identifying a relationship between the first component and the at least one application.

9. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises:

detecting a quantity of communications established by a component; and

determining whether the quantity of communications qualifies the component as a predefined type of component.

10. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises:

detecting one or more applications installed on a component; and

determining whether the installed application qualifies the component as predefined type of component.

11. The method of claim 1, wherein the act of generating at least one hypothesis of a relationship between applications of at least two components based on communication information and application information comprises determining a type of relationship between components based on:

one or more communications of a process on a first component with a second component, one or more communications between processes on one of the components, or one or more communications of a process on one or more first ports of a first component with one or more second ports on a second component.

12. The method of claim 1, wherein the act of generating at least one hypothesis of a relationship between applications of at least two components based on communication information and application information comprises:

identifying a first application installed on a first of the components;

determining one or more ports used on the first component;

determining which used ports are characteristic of a type of communication protocol or application associated with the first application;

associating determined ports with the first application;

determining which determined ports are used to communicate with ports of a second of the components; and

determining which one or more second applications on the second component are capable of communicating with the first application on the first component.

13. The method of claim 1, wherein the act of generating at least one hypothesis of a relationship between applications of at least two components based on communication information and application information comprises:

generating a schematic of components of the computer network using communication information and application information; and

matching a template of known components in a known relationship to at least a portion of the schematic; and

using characteristics associated with the template to generate the hypothesis for the portion of the schematic matching the template.

14. The method of claim 1, further comprising generating an indication of reliability for the at least one hypothesis.

15. The method of claim 1, further comprising enabling user intervention to select a relationship from at least two generated hypotheses of relationships.

16. A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to:

collect at least partial data pertaining to components of a computer network;

determine communication information and application information from the collected data, the communication information pertaining to at least some communications between components, the application information pertaining to at least some applications of components; and

generate at least one hypothesis of a relationship between applications of at least two components based on communication information and application information.

17. The program storage device of claim 16, wherein the instructions to collect comprise instructions to obtain the collected data from a database.

18. Network discovery system, comprising:

a communication network;

a plurality of components operatively coupled to the communication network;

a programmable control device operatively coupled to the communication network; and

a storage device operatively coupled to programmable control device, the storage device having stored therein program instructions for causing the programmable control device to—

collect at least partial data pertaining to components of a computer network,

determine communication information and application information from the collected data, the communication information pertaining to at least some communications between components, the application information pertaining to at least some applications of components, and

generate at least one hypothesis of a relationship between applications of at least two components based on communication information and application information.

19. The network discovery system of claim 18, wherein the instructions to collect comprise instructions to obtain the collected data from a database.

20. A computer-implemented network discovery method, comprising:

collecting data from a computer network;

identifying determinable information pertaining to at least some components, ports, communications, and applications that can be determined from collected data;

analyzing determinable information to establish at least one reliable relationship between components; and

analyzing collected data in conjunction with determinable information to generate at least one hypothetical relationship between components.

21. The method of claim 20, wherein the act of collecting comprises exploring the computer network with one or more discovery technologies.

22. The method of claim 20, wherein the act of identifying determinable information comprises determining one or more of:

listening ports of components, ports of components for several clients, opened port ranges of components, port ranges of first components communicating with port ranges of second components, and port ranges of first components communicating with individual ports of second components.

23. The method of claim 20, wherein the act of identifying determinable information comprises filtering collected data to isolate communications that use one or more predefined ports.

24. The method of claim 20, wherein the act of identifying determinable information comprises filtering collected data to remove communications that use one or more predefined ports.

25. The method of claim 20, wherein the act of identifying determinable information comprises qualifying a component as an identified type based on a type of communication established by the component, a quantity of communications established by the component, one or more identified applications installed on the component, or one or more ports used on the component.

26. The method of claim 20, wherein to establish at least one reliable relationship, the act of analyzing comprises:

determining ports used by one or more applications on the at least two components;

determining which ports are used to communicate between the at least two components; and

establishing a reliable relationship between the at least two components based on the applications associated with the ports used to communicate between the at least two components.

27. The method of claim 20, wherein to generate at least one hypothetical relationship, the act of analyzing comprises:

determining ports used by one or more applications detected on a first component;

determining which one or more ports on the first component are associated with which of the one or more applications;

determining which one or more associated ports are used to communicate with one or more ports of a second component; and

assessing which one or more second applications are capable of communicating with or are compatible with the first application on the first component.

28. The method of claim 27, wherein the act of determining which ports are associated with which applications comprises associating a port characteristic of a type of communication protocol or application with one of the applications having that type.

29. The method of claim 20, wherein to generate at least one hypothetical relationship, the act of analyzing comprises:

generating a schematic of components of the computer network using first information and collected data; and

matching a template of known components in a known relationship to at least a portion of the schematic; and

using characteristics associated with the template to generate the at least one hypothetical relationship between components of the schematic matching the template.

30. The method of claim 20, further comprising generating an indication of reliability for the at least one hypothetical relationship.

31. The method of claim 20, further comprising enabling user intervention to select a relationship from at least two hypothetical relationships.

32. A network discovery system, comprising:

a storage system for storing program instructions; and

a programmable control device operatively coupled to the storage system, wherein the program instructions stored on the storage system cause the programmable control device to;

collect data from a computer network,

identify determinable information pertaining to at least some components, ports, communications, and applications that can be determined from collected data,

analyze determinable information to establish at least one reliable relationship between components, and

analyze collected data in conjunction with determinable information to generate at least one hypothetical relationship between components.

33. A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to:

collect data from a computer network;

identify determinable information pertaining to at least some components, ports, communications, and applications that can be determined from collected data;

analyze determinable information to establish at least one reliable relationship between components; and

analyze collected data in conjunction with determinable information to generate at least one hypothetical relationship between components.