SERVICE DEPENDENCY DISCOVERY IN ENTERPRISE NETWORKS

• US 20090204696A1
• Filed: 02/13/2008
• Published: 08/13/2009
• Est. Priority Date: 02/13/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Bahl, Paramvir, Chen, Xu, Zhang, Ming
• Granted Patent: US 8,954,550 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

The claimed subject matter provides systems and/or techniques that identify service dependencies in enterprise networks. The system can include devices that, based on received network data packets, identify packets with common five tuples, aggregate the identified packets to form transactions associated with individual hosts, and determine delay distributions between one or more services solicited from or in response to the individual hosts. Based on the delay distributions, the system differentiates between dependent service pairs and independent service pairs and thereafter assembles and outputs dependency graphs that include dependency relationships between services from the perspective of a client-side and a server-side.

Claims

1. A machine implemented system that automatically effectuates and facilitates service dependency identification in enterprise networks, comprising:

a component that at least one of receives or actively acquires via an interface a network data packet, from the network data packet the component identifies a packet with a five tuple similar to a previous packet with the five tuple, the component aggregates the packet with the five tuple with the previous packet with the five tuple to form a transaction associated with an individual host, the component employs the transaction associated with the individual host to determine a delay distribution between one or more of services solicited from or in response to the individual host, the delay distribution ascertained from a perspective of the individual host, based at least in part on the delay distribution the component differentiates between a dependent service pair or an independent service pair and based on the differentiation the component assembles and outputs a dependency graph that includes dependency relationships between services from a client-side or a server-side.

2. The system of claim 1, the component employs at least one of a SYN flag or a SYN-ACK flag without a preceding SYN to indicate a start of the transaction, and at least one of a FIN flag or a RST flag to indicate an end of the transaction.

3. The system of claim 1, the component associates a sequence of contiguous packets received within a time-out period to comprise the transaction.

4. The system of claim 1, the component combines the delay distribution ascertained from the perspective of the individual host with a delay distribution determined from a perspective of a second host, the individual host and the second host perform a similar local service.

5. The system of claim 1, the component utilizes at least one of a moving average or a median filter to eliminate noise in the delay distribution.

6. The system of claim 1, the component performs spike analysis based at least in part on thresholding.

7. The system of claim 1, the five tuple includes one or more of a source IP address, a source port number, a destination IP address, a destination port number, or a protocol type.

8. The system of claim 1, the component stores flow level information in a global hash-table utilizing the five tuple as an index key.

9. The system of claim 1, the transaction includes a local end or a remote end, based at least in part on a frequency of requests received from the local end or the remote end a determination of an actual service is performed.

10. A method implemented on a machine that identifies service dependencies in an enterprise network, comprising:

identifying a packet with a five tuple similar to a previous packet with the five tuple;

aggregating the packet with the five tuple with the previous packet with the five tuple to form a transaction associated with a first host;

utilizing the transaction associated with the first host to ascertain a delay distribution between one or more of services solicited from the first host, the delay distribution ascertained from a perspective of the first host;

based at least in part on the delay distribution, differentiating between a dependent service pair or an independent service pair; and

dynamically constructing a dependency graph that identifies service dependencies in the enterprise network.

11. The method of claim 10, further comprising parsing the packet utilizing a SYN flag or a SYN-ACK flag without a preceding SYN component to indicate a start of the transaction.

12. The method of claim 10, further comprising parsing the packet utilizing a FIN or RST flag to identify an end of the transaction.

13. The method of claim 10, further comprising aggregating the delay distribution determined from a perspective of the first host with a delay distribution ascertained from a perspective of a second host.

14. The method of claim 10, further comprising eliminating noise in the delay distribution through utilization of at least one of a median filter or a moving average.

15. The method of claim 10, further comprising identifying false positives introduced by a periodic access by the first host to a service.

16. A system that identifies service dependencies in an enterprise network, comprising:

means for locating a packet with a five tuple similar to a previous packet with the five tuple;

means for associating the packet with the five tuple with the previous packet with the five tuple to form a transaction associated with a first host;

means for ascertaining a delay distribution between one or more of services solicited from the first host;

means for differentiating between a dependent service pair or an independent service pair based at least in part on the delay distribution; and

means for automatically assembling or displaying a dependency graph that identifies service dependencies in the enterprise network based on the delay distribution.

17. The system of claim 16, further comprising means for associating a sequence of contiguous packets received within a time-out period to comprise the transaction.

18. The system of claim 16, further comprising means for eliminating false positives that compares a first half of the delay distribution with a second half of the delay distribution, the means for eliminating invokes a means for detecting spikes where a ratio of the first half of the delay distribution to the second half of the delay distribution exceeds a limit.

19. The system of claim 16, the five tuple includes one or more of a source IP address, a source port number, a destination IP address, a destination port number, or a protocol type.

20. The system of claim 16, further comprising means for aggregating the delay distribution associated with the first host with the delay distribution associated with a second host.