LOGICAL NETWORK TOPOLOGY ANALYZER

• US 20170295068A1
• Filed: 04/21/2016
• Published: 10/12/2017
• Est. Priority Date: 04/06/2016
• Status: Abandoned Application

• Current Assignee: Omni AI, Inc.
• Original Assignee: Omni International, LLC (Blue Sail Medical Co., Ltd.)
• Inventors: YANG, Tao, SEOW, Ming-Jung, XU, Gang
• Application Number:
  US15/135,382
• Publication Number:
  US 20170295068A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Techniques are disclosed for building a logical network topology in a computer network. According to one embodiment of the present disclosure, traffic activity in the computer network is monitored. One or more attributes of the computer network (e.g., patterns of connectivity, intensity, and frequency between network components) is identified based on the monitored traffic activity. The logical network topology is generated from the one or more network traffic attributes.

Claims

1. A computer-implemented method for generating a logical network topology in a computer network, the method comprising:

monitoring traffic activity in the computer network;

identifying one or more network traffic attributes of the computer network based on the monitored traffic activity; and

building the logical network topology from the one or more network traffic attributes.

2. The method of claim 1, further comprising:

receiving a network packet;

identifying one or more feature values from the packet;

evaluating the feature values relative to statistical data of the computer network; and

updating the logical network topology based on the evaluation.

3. The method of claim 1, wherein the network traffic attributes includes at least one of a connectivity pattern, frequency pattern, and an intensity pattern associated with a component in the computer network.

4. The method of claim 1, wherein monitoring the traffic activity in the computer network comprises:

evaluating a header of at least a first packet being sent to a computing node or networking device in the computer network.

5. The method of claim 1, further comprising:

persisting the logical network topology in memory.

6. The method of claim 1, wherein building the logical network topology from the one or more network traffic attributes comprises:

mapping at least one of the identified network attributes to a corresponding network component.

7. The method of claim 1, wherein the logical network topology provides contextual information regarding components in the computer network.

8. A non-transitory computer-readable storage medium having instructions, which, when executed on a processor, performs an operation for generating a logical network topology in a computer network, comprising:

monitoring traffic activity in the computer network;

identifying one or more network traffic attributes of the computer network based on the monitored traffic activity; and

building the logical network topology from the one or more network traffic attributes.

9. The computer-readable storage medium of claim 8, wherein the operation further comprises:

receiving a network packet;

identifying one or more feature values from the packet;

evaluating the feature values relative to statistical data of the computer network; and

updating the logical network topology based on the evaluation.

10. The computer-readable storage medium of claim 8, wherein the network traffic attributes includes at least one of a connectivity pattern, frequency pattern, and an intensity pattern associated with a component in the computer network.

11. The computer-readable storage medium of claim 8, wherein monitoring the traffic activity in the computer network comprises:

evaluating a header of at least a first packet being sent to a computing node or networking device in the computer network.

12. The computer-readable storage medium of claim 8, wherein the operation further comprises:

persisting the logical network topology in memory.

13. The computer-readable storage medium of claim 8, wherein building the logical network topology from the one or more network traffic attributes comprises:

mapping at least one of the identified network traffic attributes to a corresponding network component.

14. The computer-readable storage medium of claim 8, wherein the logical network topology provides contextual information regarding components in the computer network.

15. A system, comprising:

a processor; and

a memory storing code, which, when executed on the processor, performs an operation for generating a logical network topology in a computer network, comprising;

monitoring traffic activity in the computer network;

identifying one or more network traffic attributes of the computer network based on the monitored traffic activity; and

building the logical network topology from the one or more network traffic attributes.

16. The system of claim 15, wherein the operation further comprises:

receiving a network packet;

identifying one or more feature values from the packet;

evaluating the feature values relative to statistical data of the computer network; and

updating the logical network topology based on the evaluation.

17. The system of claim 15, wherein the network traffic attributes includes at least one of a connectivity pattern, frequency pattern, and an intensity pattern associated with a component in the computer network.

18. The system of claim 15, wherein monitoring the traffic activity in the computer network comprises:

evaluating a header of at least a first packet being sent to a computing node or networking device in the computer network.

19. The system of claim 15, wherein building the logical network topology from the one or more network traffic attributes comprises:

mapping at least one of the identified network attributes to a corresponding network component.

20. The system of claim 15, wherein the logical network topology provides contextual information regarding components in the computer network.