METHOD, DEVICE ARRANGEMENT AND COMPUTER PROGRAM PRODUCT FOR PRODUCING IDENTITY GRAPHS FOR ANALYZING COMMUNICATION NETWORK

• US 20090244069A1
• Filed: 03/31/2009
• Published: 10/01/2009
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: Software Integrity Group Incorporated
• Original Assignee: Clarified Networks Oy (Synopsys Incorporated)
• Inventors: LAAKSO, Marko, HUHTA, Jyrki, KENTTALA, Jani
• Granted Patent: US 8,654,127 B2
• Time in Patent Office: Days
• US Class Current: 345/440
• CPC Class Codes: G06T 11/203 Drawing of straight lines or curves
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/026 using flow identification

Abstract

A method, a device arrangement and a computer program product for examining and analyzing the functioning of a communication network. In one or more taps of the examined communication network there is a network probe which examines communication packets flowing in the communication network via a tap and searches for identities and their relations from their header information. Identities and relations between them are used to create an identity flow which is used to create an identity graph for describing the operation of the communication network. A network probe(s) sends all or a part of the data of the traffic of the communication network it has collected or analyzed to a supervisor unit. The data is sent according to previously given instructions or by a request sent by the supervisor unit. The identities and relations between them to be included in the identity graph are chosen according to predetermined modifiers.

Claims

1. A method for recognizing relations between and internal relations of taps in a packet connected communication network which method registers and stores connections detected in the communication network by means located in the communication network, characterized in that in the method header information connected to connections of the communication network is examined, which header information is searched for identities and relations between them, which identities and relations are modelled, stored or visualized as one or more identity flows and these, or a part of them, are used for creating an identity graph for analyzing functioning of the communication network.

2. A method according to claim 1, characterized in that a data structure has been created from the identity flow of the communication network which data structure is used by the supervisor unit for creating an identity graph.

3. A method according to claim 1, characterized in that connections are observed by means of a network probe which is a device that can be connected to the communication network or a computer program product which is in a device connected to the communication network.

4. A method according to claim 3, characterized in that at least part of analysis of the data collected from connections is executed in a network probe.

5. A method according to claim 3, characterized in that at least a part of the data gathered or analysed by a network probe is sent to the supervisor unit which performs the final analysis.

6. A method according to claim 1, characterized in that the identities and their relations to be included in an identity graph are chosen according to predetermined modifiers.

7. A method according to claim 5, characterized in that the supervisor unit makes requests to the network probes for sending information if the data structure does not contain needed information for creating an identity graph.

8. A method according to claim 1, characterized in that the temporal or local changes of the identities and relations between them at one tap or between two or more taps are found out with the identity graph created by the method.

9. A device arrangement for analyzing internal relations of taps and relations between taps in a packet connected communication network in which communication network there are means to store connections detected in the communication network, characterized in that the device arrangement has been arranged to create a data structure from the identity flows collected by said means and to create from the data of the data structure an identity graph analysing the functioning of the communication network.

10. A device arrangement according to claim 9, characterized in that it is arranged to create an identity graph according to the modifiers given to it.

11. A device arrangement according to claim 9, characterized in that if identities and relations between them according to the modifiers are not found from the data structure of the device arrangement, the device arrangement has been arranged to send a request for the missing information to the means storing connections of the communication network.

12. A device arrangement according to claim 9, characterized in that the device arrangement is arranged to send a checking request to the means storing the connections of the communication network, which checking request checks if the means storing the connections of the communication network has stored such identities and their relations fulfilling the modifiers which are not included in the data structure.

13. A device arrangement according to claim 9, characterized in that the device arrangement is arranged to receive and store in the data structure information sent by the means storing the connections of the communication network.

14. A computer program product stored to a data storage medium for recognizing internal relations of taps and relations between taps in a packet connected communication network, characterized in that it comprises computer program code means which are arranged to passively search for identities and relations between them from the identity flow of the communication network from header information of packets relayed in the communication network or from the description of the packets in question.

15. A computer program product according to claim 14, characterized in that it further comprises computer program code means which are arranged to analyze information collected from identities and their relations.

16. A computer program product according to claim 14, characterized in that it further comprises computer program code means which are arranged to store at least a part of the identities and their relations they have found to the data storage.

17. A computer program product according to claim 14, characterized in that it further comprises computer program code means which are arranged to send collected data either according to predetermined rules or on grounds of a received request.

18. A computer program product stored to a data storage medium for analysing internal relations of taps and relations between taps in a packet connected communication network in which communication network there are means capable of storing connections detected in the communication network, characterized in that it comprises computer program code means for creating an identity graph for analysing functioning of the communication network from the identity flow.

19. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to receive data about identities and their relations sent by the means for storing connections of the communication network.

20. A computer program product according to claim 18, characterized in that it further comprises computer program code means for creating a data structure from the identities and their relations of the examined communication network.

21. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to receive modifiers which define the identities and their relations that are to be included in an identity graph analysing the communication network.

22. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to send a request to the means for storing the connections of communication network if the data structure does not contain identities and their relations according to the modifiers.

23. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to send a checking request to the means for storing the connections of the communication network in which checking request to the means for storing the connections of the communication network a request to check if their data storages contain such identities and their relations that fulfil the modifiers that the data structure does not have is presented.

24. A computer program product according to claim 18, characterized in that the means for storing the connections of the communication network is a computer program product which comprises computer program code means which are arranged to passively search for identities and relations between them from the identity flow of the communication network from the header information of packets relayed in the communication network or the description of packets in question.

25. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to create an identity graph for analysing the communication network in which identity graph the identities and their relations to be included in it are chosen according to the given modifiers.

26. A computer program product according to claim 18, characterized in that it further comprises computer program code means which are arranged to create identity graphs for analysing the communication network which identity graphs present the temporal or local changes of identities and relations between them in one tap or between two or more taps.

27. A computer program product according to claim 18, characterized in that it is in some data processing device which is outside the examined communication system.