Application data flow management in an IP network

• US 8,504,687 B2
• Filed: 11/26/2008
• Issued: 08/06/2013
• Est. Priority Date: 11/26/2008
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Maffione, Eugenio Maria, Garofalo, Angelo, Bincoletto, Luca
• Primary Examiner(s): Donabed, Ninos
• Application Number:
  US13/131,564
• Publication Number:
  US 20110238825A1
• Time in Patent Office: 1,714 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

Disclosed herein is a two-level, network-based application control (NBAC) architecture for monitoring services provided via a packet-based network. The NBAC architecture includes a Network Trigger System provided at a network level to analyze data flows relating to services to be monitored to detect occurrence of configurable events, and to generate and send event reports; and a Usage Status Engine provided at a control level to configure the Network Trigger System to detect occurrence of events of interest, and to receive and process the event reports from the Network Trigger System to monitor the services.

Claims

1. A two-level, network-based application control architecture for monitoring services provided via a packet-based network, comprising:

a first computing device at a network level and a second computing device at a control level,

wherein the first computing device at the network level;

analyzes data flows relating to services to be monitored,

detects occurrence of configurable events, including a request for connection to a first service of the services to be monitored,

generates and sends event reports to the second computing device, wherein at least one event report sent to the second computing device identifies the request for connection to the first service and includes corresponding data related to a connection setup and a generated traffic; and

wherein the second computing device at the control level;

configures the first computing device to detect occurrence of events of interest in the analyzed data flows,

receives and processes the event reports from the first computing device to monitor the services,

in response to receiving the corresponding data related to the connection setup and the generated traffic from the first computing device, generates and stores a Finite State Automaton in memory, the Finite State Automaton having states associated with phases of the connection to the first service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the first service,

associate a second monitored service of the services to be monitored with a second Finite State Automaton stored in memory, the second Finite State Automaton having states associated with phases of the connection to the second service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the second service; and

cause the second Finite State Automaton to evolve based on the received event reports, to monitor the second service,

wherein the Finite State Automaton further has a callback function which is associated with an entry into or an exit from a state of the Finite State Automaton, or with a state-to-state transition of the Finite State Automaton, and takes actions at both an application level and the control level.

2. The architecture of claim 1, wherein the configurable events include configurable patterns in the analyzed data flows.

3. The architecture according to claim 2, wherein the first computing device detects a specific pattern in an analyzed data flow by carrying out a pattern matching based on Deep Packet Inspection.

4. The architecture of claim 1, wherein the second computing device creates the Finite State Automaton specific for the first service.

5. The architecture of claim 4, wherein the second computing device:

stores a Finite State Automaton template for each service to be monitored; and

generates the Finite State Automaton specific for the monitored service by instantiating the corresponding Finite State Automaton template.

6. The architecture of claim 1, wherein the second computing device dispatches a received event report to the Finite State Automaton.

7. The architecture according to claim 1, wherein the second computing device receives and interprets a configuration file containing configuration settings for the first computing device and the second computing device.

8. The architecture of claim 7, wherein the configuration file includes:

patterns and associated application usage parameters to be detected in the analyzed data flows; and

Finite State Automaton templates for the services to be monitored, wherein the Finite State Automaton templates are stored in memory.

9. The architecture according to claim 1, wherein the second computing device stores in a database all data received from the first computing device.

10. The architecture according to claim 9, wherein the second computing device correlates data received from the first computing device and relating to the analyzed data flows.

11. The architecture according to claim 1, wherein the second computing device associates one or more capabilities with the monitored services.

12. The architecture according to claim 1, wherein the first computing device provides a plurality of modules arranged in different points of the network to analyze data flows therein.

13. The architecture according to claim 1, wherein the second computing device provides a plurality of modules specialized for specific application domains.

14. The architecture according to claim 1, wherein the services to be monitored are Non-Session-based services.

15. A method for monitoring services provided via a packet-based network, comprising:

providing a two-level, network-based application control architecture including;

a first computing device provided at a network level and a second computing device provided at a control level,

performing steps by the first computing device provided at the network level to;

analyze data flows relating to services to be monitored,

detect occurrence of configurable events, including a request for connection to a first service of the services to be monitored,

generate and send event reports to the second computing device, wherein at least one event report sent to the second computing device identifies the request for connection to the first service and includes corresponding data related to the connection setup and the generated traffic; and

performing steps by the second computing device provided at the control level to;

configure the first computing device to detect occurrence of events of interest in the analyzed data flows,

receive and process the event reports from the first computing device to monitor the services,

in response to receiving the corresponding data related to the connection setup and the generated traffic from the first computing device, generate and store a Finite State Automaton in memory, the Finite State Automaton having states associated with phases of the connection to the first service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the first service,

associate a second monitored service of the services to be monitored with a second Finite State Automaton stored in memory, the second Finite State Automaton having states associated with phases of the connection to the second service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the second service; and

cause the second Finite State Automaton to evolve based on the received event reports, to monitor the second service,

wherein the Finite State Automaton further has a callback function which is associated with an entry into or an exit from a state of the Finite State Automaton, or with a state-to-state transition of the Finite State Automaton, and which takes actions at both an application level and the control level.

16. Non-transitory computer readable media having software modules stored thereon that, when executed by a processing system, implement a system comprising:

a first computing device at a network level and a second computing device at a control level,

wherein the first computing device at the network level;

analyzes data flows relating to services to be monitored,

detects occurrence of configurable events, including a request for connection to a first service of the services to be monitored,

generates and sends event reports to the second computing device, wherein at least one event report sent to the second computing device identifies the request for connection to the first service and includes corresponding data related to a connection setup and a generated traffic; and

wherein the second computing device at the control level;

configures the first computing device to detect occurrence of events of interest in the analyzed data flows,

receives and processes the event reports from the first computing device to monitor the services,

in response to receiving the corresponding data related to the connection setup and the generated traffic from the first computing device, generate and store a Finite State Automaton in memory, the Finite State Automaton having states associated with phases of the connection to the first service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the first service,

associate a second monitored service of the services to be monitored with a second Finite State Automaton stored in memory, the second Finite State Automaton having states associated with phases of the connection to the second service, and state-to-state transitions associated with events the occurrence of which is detected in the analyzed data flows, to provide a representation of possible phases of connection to the second service; and

cause the second Finite State Automaton to evolve based on the received event reports, to monitor the second service,

wherein the Finite State Automaton further has a callback function which is associated with an entry into or an exit from a state of the Finite State Automaton, or with a state-to-state transition of the Finite State Automaton, and which takes actions at both an application level and the control level.