ANOMALY DETECTION BASED ON COMBINATIONS OF CAUSE VALUE, MESSAGE TYPE, RESPONSE TIME (GTP-C)

• US 20160065444A1
• Filed: 08/26/2014
• Published: 03/03/2016
• Est. Priority Date: 08/26/2014
• Status: Abandoned Application

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Schunder, Mark, Reed, R. G., Welch, Joseph, Anderson, Carl, Markel, Joanna
• Application Number:
  US14/469,275
• Publication Number:
  US 20160065444A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04W 24/04 Arrangements for maintaining operational condition
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports

Abstract

A method for monitoring control traffic in a network is provided. A network monitoring probe passively monitors one or more network performance metrics related to control traffic. A plurality of threshold values associated with the one or more network performance metrics is received from a user. An alert notification message is sent to the user via an alert engine, in response to determining that at least one of the plurality of threshold values has been reached by the control traffic.

Claims

1. A method for monitoring control traffic in a network, the method comprising:

monitoring, by a network monitoring probe, one or more network performance metrics related to control traffic;

receiving from a user a plurality of threshold values associated with the one or more network performance metrics; and

sending an alert notification message to the user via an alert engine, in response to determining that at least one of the plurality of threshold values has been reached by the control traffic.

2. The method of claim 1, wherein the one or more network performance metrics include one or more of:

a value indicative of an overall volume of control traffic, response time values, cause values.

3. The method of claim 1, wherein said step of monitoring comprises the network monitoring probe monitoring the one or more network performance metrics related to control traffic at a particular network node within the network.

4. The method of claim 3, wherein the particular network node comprises one of a Serving GPRS Support Node (SGSN) and a Gateway GPRS Support Node (GGSN).

5. The method of claim 1, further comprising analyzing the one or more network performance metrics for a predetermined period of time.

6. The method of claim 5, further comprising displaying to a user information related to the one or more network performance metrics for the predetermined period of time based on the analyzing step.

7. The method of claim 6, wherein the step of displaying further comprises generating a sparkline based on the analysis of the one or more network performance metrics for the predetermined period of time.

8. The method of claim 7, further comprising updating the sparkline in response to user'"'"'s input associated with the plurality of threshold values.

9. The method of claim 7, further comprising displaying a line graph corresponding to the generated sparkline, in response to user'"'"'s interaction with the generated sparkline.

10. The method of claim 9, further comprising updating the corresponding sparkline, in response to user'"'"'s interaction with the line graph.

11. The method of claim 9, further comprising updating at least one of the plurality of threshold values, in response to user'"'"'s interaction with the line graph.

12. The method of claim 5, further comprising analyzing one or more conditions associated with the one or more network performance metrics for the predetermined period of time.

13. A computer program product for monitoring control traffic in a network, the computer program product comprising:

one or more computer-readable storage devices and a plurality of program instructions stored on at least one of the one or more computer-readable storage devices, the plurality of program instructions comprising;

program instructions to monitor one or more network performance metrics related to control traffic;

program instructions to receive from a user a plurality of threshold values associated with the one or more network performance metrics; and

program instructions to send an alert notification message to the user, in response to determining that at least one of the plurality of threshold values has been reached by the control traffic.

14. The computer program product of claim 13, wherein the one or more network performance metrics include one or more of:

a value indicative of an overall volume of control traffic, response time values, cause values.

15. The computer program product of claim 13, wherein said program instructions to monitor one or more network performance metrics related to control traffic comprise program instructions performed by a network monitoring probe monitoring the one or more network performance metrics related to control traffic at a particular network node within the network.

16. The computer program product of claim 15, wherein the particular network node comprises one of a Serving GPRS Support Node (SGSN) and a Gateway GPRS Support Node (GGSN).

17. The computer program product of claim 13, further comprising program instructions to analyze the one or more network performance metrics for a predetermined period of time.

18. The computer program product of claim 17, further comprising program instructions to generate a sparkline based on the analysis of the one or more network performance metrics for the predetermined period of time.

19. The computer program product of claim 18, further comprising program instructions to display a line graph corresponding to the generated sparkline, in response to user'"'"'s interaction with the generated sparkline.

20. A computer system for monitoring control traffic in a network, the computer system comprising one or more processors, one or more computer-readable storage devices, and a plurality of program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors, the plurality of program instructions comprising:

program instructions to monitor one or more network performance metrics related to control traffic;

program instructions to receive from a user a plurality of threshold values associated with the one or more network performance metrics; and

program instructions to send an alert notification message to the user, in response to determining that at least one of the plurality of threshold values has been reached by the control traffic.