USING A FLOW DATABASE TO AUTOMATICALLY CONFIGURE NETWORK TRAFFIC VISIBILITY SYSTEMS

• US 20180183714A1
• Filed: 12/22/2016
• Published: 06/28/2018
• Est. Priority Date: 12/22/2016
• Status: Active Grant

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Hay, Ronald G., Winquist, James E., Mortensen, Andrew D., Northway, JR., William M., Huston, III, Lawrence B.
• Granted Patent: US 11,343,143 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for configuring a network monitoring device is provided. A plurality of flow records is received. The plurality of flow records is analyzed according to user-specified criteria to identify one or more network traffic patterns. A plurality of network entities associated with the one or more identified network traffic patterns is identified. A managed object including the identified plurality of network entities is generated.

Claims

1. A method for automatically configuring a network traffic monitoring system, the method comprising steps of:

receiving a plurality of flow records;

analyzing the plurality of flow records according to user-specified criteria to identify one or more network traffic patterns;

identifying a plurality of network entities associated with the one or more identified network traffic patterns; and

generating a managed object comprising the identified plurality of network entities.

2. The method as recited in claim 1, wherein the plurality of flow records are stored in a flow record repository.

3. The method as recited in claim 1, wherein the step of generating the managed object further comprises analyzing one or more pre-existing managed objects associated with the identified plurality of network entities and suggesting configuration changes for the one or more pre-existing managed objects based on the analysis.

4. The method as recited in claim 1, wherein relationships between the plurality of network entities and the one or more identified network traffic patterns are derived based upon any of communications between the entities.

5. The method as recited in claim 1, wherein the user-specified criteria are associated with one or more network attacks and wherein the identified plurality of network entities comprises network entities targeted by the one or more network attacks.

6. The method as recited in claim 1, wherein the step of analyzing the plurality of flow records further comprises for each one of the plurality of flow records estimating a path that network traffic that belongs to that flow at least likely flows through and wherein the identified plurality of network entities includes one or more network entities along the estimated path.

7. The method as recited in claim 1, wherein the step of analyzing the plurality of flow records further comprises for each one of the plurality of flow records determining a portion of network traffic that belongs to that flow and that is not associated with any of pre-existing managed objects.

8. The method as recited in claim 7, wherein generating the managed object further comprises generating the managed object associated with the determined portion of network traffic.

9. A monitoring system comprising:

a monitored network comprising a plurality of devices;

a storage repository for storing network traffic flow information; and

one or more network monitoring devices communicatively coupled to the monitored network and to the storage repository, wherein the one or more network monitoring devices are configured and operable to;

receive from the storage repository a plurality of flow records;

analyze the plurality of flow records according to user-specified criteria to identify one or more network traffic patterns;

identify a plurality of network entities associated with the one or more identified network traffic patterns; and

generate a managed object comprising the identified plurality of network entities.

10. The monitoring system as recited in claim 9, wherein the one or more network monitoring devices configured and operable to generate the managed object are further configured and operable to analyze one or more pre-existing managed objects associated with the identified plurality of network entities and suggest configuration changes for the one or more pre-existing managed objects based on the analysis.

11. The monitoring system as recited in claim 9, wherein relationships between the plurality of network entities and the one or more identified network traffic patterns are derived based upon any of communications between the entities.

12. The monitoring system as recited in claim 9, wherein the user-specified criteria are associated with one or more network attacks and wherein the identified plurality of network entities comprises network entities targeted by the one or more network attacks.

13. The monitoring system as recited in claim 9, wherein the one or more network monitoring devices configured and operable to analyze the plurality of flow records are further configured and operable to, for each one of the plurality of flow records, estimate a path that network traffic that belongs to that flow at least likely flows through and wherein the identified plurality of network entities includes one or more network entities along the estimated path.

14. The monitoring system as recited in claim 9, wherein the one or more network monitoring devices configured and operable to analyze the plurality of flow records are further configured and operable to, for each one of the plurality of flow records, determine a portion of network traffic that belongs to that flow and that is not associated with any of pre-existing managed objects.

15. The monitoring system as recited in claim 14, wherein the one or more network monitoring devices configured and operable to generate the managed object are further configured and operable to generate the managed object associated with the determined portion of network traffic.

16. A network monitoring device configured and operable to:

receive from the storage repository a plurality of flow records;

analyze the plurality of flow records according to user-specified criteria to identify one or more network traffic patterns;

identify a plurality of network entities associated with the one or more identified network traffic patterns; and

generate a managed object comprising the identified plurality of network entities.

17. The network monitoring device as recited in claim 16, further configured and operable to analyze one or more pre-existing managed objects associated with the identified plurality of network entities and suggests configuration changes for the one or more pre-existing managed objects based on the analysis.

18. The network monitoring device as recited in claim 16, wherein relationships between the plurality of network entities and the one or more identified network traffic patterns are derived based upon any of communications between the entities.

19. The network monitoring device as recited in claim 16, wherein the user-specified criteria are associated with one or more network attacks and wherein the identified plurality of network entities comprises network entities targeted by the one or more network attacks.

20. The monitoring system as recited in claim 16, further configured and operable to, for each one of the plurality of flow records, estimate a path that network traffic that belongs to that flow at least likely flows through and wherein the identified plurality of network entities includes one or more network entities along the estimated path.