Automatic discovery of service/host dependencies in computer networks
First Claim
1. A method for detecting correlation between an input channel and an output channel, comprising:
- generating packet data by observing packets sent and received through the input and output channels for a window of time;
generating, by a processor, a model of inter-arrival time of packets received on the input channel and packets sent on the output channel;
generating, by the processor, a model of predecessor waiting time for packets received on the input channel;
determining a difference between the model of inter-arrival time and the model of predecessor waiting time; and
determining that the input and output channels are correlated if the difference is greater than a threshold.
2 Assignments
0 Petitions
Accused Products
Abstract
An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing channels for packets for a predetermined window of time. To generate an activity model, an input and an output channel are selected. A probability distribution function describing the observed waiting time between packet arrivals on the selected input channel and the selected output channel is generated by mining the data collected during the selected window of time. A probability distribution function describing the observed waiting time between a randomly chosen instant and receiving a packet on the selected input channel is also generated. The distance between the two generated probability distribution functions is computed. If the computed distance is greater than a predefined confidence level, then the two selected channels are deemed to be related. Otherwise, the selected channels are deemed to be unrelated. The activity model is further generated by comparing each input and output channel pair entering or leaving a particular computer.
35 Citations
20 Claims
-
1. A method for detecting correlation between an input channel and an output channel, comprising:
-
generating packet data by observing packets sent and received through the input and output channels for a window of time; generating, by a processor, a model of inter-arrival time of packets received on the input channel and packets sent on the output channel; generating, by the processor, a model of predecessor waiting time for packets received on the input channel; determining a difference between the model of inter-arrival time and the model of predecessor waiting time; and determining that the input and output channels are correlated if the difference is greater than a threshold. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A tangible computer-readable storage medium, excluding transmission media and carrier waves, with computer-executable instructions stored thereon that when executed by a processor perform a method comprising:
-
generating packet data by observing packets sent and received through an input channel and an output channel for a window of time; generating a model of inter-arrival time of packets received on the input channel and packets sent on the output channel; generating a model of predecessor waiting time for packets received on the input channel; determining a difference between the model of inter-arrival time and the model of predecessor waiting time; and determining that the input and output channels are correlated if the difference is greater than a threshold. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A computer system comprising a processor and at least one input and one output channels, configured to:
-
generate packet data by observing packets sent and received through the input and the output channels for a window of time; generate a model of inter-arrival time of packets received on the input channel and packets sent on the output channel; generate a model of predecessor waiting time for packets received on the input channel; determine a difference between the model of inter-arrival time and the model of predecessor waiting time; and determine that the input and output channels are correlated if the difference is greater than a threshold. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification