Automatic Grouping of Similar Applications and Devices on a Network Map

• US 20190044820A1
• Filed: 03/28/2018
• Published: 02/07/2019
• Est. Priority Date: 08/01/2017
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: ServiceNow Incorporated
• Inventors: Rosh, Haviv, Tilikin, Alexei
• Granted Patent: US 10,992,537 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

An embodiment may involve a managed network containing computing devices. The computing devices may be respectively associated with unqualified domain names. One or more server devices may be disposed within a remote network management platform that manages the managed network. These server devices may be configured to: probe the managed network, by way of a proxy server application disposed within the managed network, to obtain information related to applications operating on the computing devices, network connectivity of the computing devices, and representations of the unqualified domain names; obtain a regular expression; determine a subset of the computing devices in the managed network on which a particular application is operating and for which the respectively associated unqualified domain names match the regular expression; and generate a map of the managed network in which the subset of the computing devices is represented as a grouped node instead of individual nodes.

Claims

1. A system comprising:

a managed network containing a plurality of computing devices; and

a proxy server device disposed behind a firewall of the managed network containing programming instructions that cause the proxy server device to probe and discover computing devices from the plurality of computing devices by;

scanning the managed network to;

identify the computing devices from the plurality of computing devices included in the managed network; and

for each identified computing device, identify an operating system running on the computing device;

classifying each of the of the identified computing devices based on the identified operating system for the identified computing device;

sending probe messages to the identified computing devices;

receiving responses from the identified computing devices;

processing the responses to obtain additional details about the identified computing devices, wherein, for at least some of the identified computing devices, the additional details comprise an application running on that identified computing device; and

generating a map of the managed network, wherein the applications operating on the identified computing devices are represented as individual nodes in the map, and wherein edges between the individual nodes are defined based on the network connectivity of the plurality of computing devices, and

display, on a display of a client device, a representation of the map.

2. The system of claim 1, wherein the instructions to identify the operating system running on the computing device comprises instructions to:

probe a group of IP addresses for open ports; and

for each IP address at which an open port is present, identify the open port and, based on the port, identify the operating system as an operating system that is associated with the open port.

3. The system of claim 2, wherein the instructions to send probe messages to the identified computing devices comprise instructions to:

for each identified computing device, send a message that is specific to the identified operating system for that identified computing device.

4. The system of claim 1, wherein the instructions that cause the proxy server device to probe and discover the computing devices further comprise:

for each identified computing device, generate a snapshot representation of each identified computing device, wherein each snapshot representation comprises the identified operating system, a version of the identified operating system, and an application configured to run on the identified computing device; and

store each generated snapshot representation to a computer-readable memory device.

5. The system of claim 4, wherein the instructions to generate the snapshot representation of each identified computing device comprises instructions to:

for each identified computing device;

identify one or more other services that rely on the application that is included in the snapshot; and

represent the one or more other services in the snapshot so that an impact on the one or more other services may be identified when the identified computing device is taken out of operation.

6. The system of claim 1, wherein the instructions that cause the proxy server device to probe and discover the computing devices further comprises instructions to:

group a subset of the applications as a grouped node; and

wherein the representation of the map displays the grouped node.

7. A method comprising:

causing a proxy server device disposed behind a firewall of a managed network to probe and discover computing devices from a plurality of computing devices included in the managed network by;

scanning the managed network to;

identify the computing devices from the plurality of computing devices in the managed network; and

for each identified computing device, identify an operating system running on the computing device;

classifying each of the of the identified computing devices based on the identified operating system for the identified computing device;

sending probe messages to the identified computing devices;

receiving responses from the identified computing devices;

processing the responses to obtain additional details about the identified computing devices, wherein, for at least some of the identified computing devices, the additional details comprise an application running on that identified computing device; and

generating a map of the managed network, wherein the applications operating on the identified computing devices are represented as individual nodes in the map, and wherein edges between the individual nodes are defined based on the network connectivity of the plurality of computing devices; and

display, on a display of a client device, a representation of the map.

8. The method of claim 7, wherein identifying the operating system running on the computing device comprises:

probing a group of IP addresses for open ports; and

for each IP address at which an open port is present, identifying the open port and, based on the port, identify the operating system as an operating system that is associated with the open port.

9. The method of claim 8, wherein sending probe messages to the identified computing devices comprises:

for each identified computing device, send a message that is specific to the identified operating system for that identified computing device.

10. The method of claim 7, wherein causing the proxy server device to probe and discover the computing devices further comprises:

for each identified computing device, generate a snapshot representation of each identified computing device, wherein each snapshot representation comprises the identified operating system, a version of the identified operating system, and an application configured to run on the identified computing device; and

store each generated snapshot representation to a computer-readable memory device.

11. The method of claim 10, wherein generating the snapshot representation of each identified computing device comprises:

for each identified computing device;

identify one or more other services that rely on the application that is included in the snapshot; and

represent the one or more other services in the snapshot so that an impact on the one or more other services may be identified if the identified computing device is taken out of operation.

12. The method of claim 7, wherein causing the proxy server device to probe and discover the computing devices further comprises:

grouping a subset of the applications as a grouped node; and

wherein the representation of the map displays the grouped node.

13. A non-transitory computer readable medium encoded with instructions, executable by a processing device, comprising:

causing a proxy server device disposed behind a firewall of a managed network to probe and discover computing devices from a plurality of computing devices included in the managed network by;

scanning the managed network to;

identify the computing devices from the plurality of computing devices in the managed network; and

for each identified computing device, identify an operating system running on the computing device;

classifying each of the of the identified computing devices based on the identified operating system for the identified computing device;

sending probe messages to the identified computing devices;

receiving responses from the identified computing devices;

processing the responses to obtain additional details about the identified computing devices, wherein, for at least some of the identified computing devices, the additional details comprise an application running on that identified computing device; and

generating a map of the managed network, wherein the applications operating on the identified computing devices are represented as individual nodes in the map, and wherein edges between the individual nodes are defined based on the network connectivity of the plurality of computing devices, and

display, on a display of a client device, a representation of the map.

14. The non-transitory computer readable medium of claim 13, wherein identifying the operating system running on the computing device comprises:

probing a group of IP addresses for open ports; and

for each IP address at which an open port is present, identifying the open port and, based on the port, identify the operating system as an operating system that is associated with the open port.

15. The non-transitory computer readable medium of claim 14, wherein sending probe messages to the identified computing devices further comprises:

for each identified computing device, send a message that is specific to the identified operating system for that identified computing device.

16. The non-transitory computer readable medium of claim 13, wherein causing the proxy server device to probe and discover the computing devices further comprises:

for each identified computing device, generate a snapshot representation of each identified computing device, wherein each snapshot representation comprises the identified operating system, a version of the identified operating system, and an application configured to run on the identified computing device; and

store each generated snapshot representation to a computer-readable memory device.

17. The non-transitory computer readable medium of claim 16, wherein generating the snapshot representation of each identified computing device further comprises:

for each identified computing device;

identify one or more other services that rely on the application that is included in the snapshot; and

represent the one or more other services in the snapshot so that an impact on the one or more other services may be identified if the identified computing device is taken out of operation.

18. The non-transitory computer readable medium of claim 13, wherein causing the proxy server device to probe and discover computing devices included in the managed network including the plurality of computing devices further comprises:

grouping a subset of the applications as a grouped node; and

wherein the representation of the map displays the grouped node.