Parallel processing for multiple instance real-time monitoring

• US 8,547,975 B2
• Filed: 06/28/2011
• Issued: 10/01/2013
• Est. Priority Date: 06/28/2011
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Gallant, John Kenneth, Nalluri, Jagadeesh Babu, Miller, Steven D.
• Primary Examiner(s): Pham, Brenda H
• Application Number:
  US13/170,528
• Publication Number:
  US 20130003567A1
• Time in Patent Office: 826 Days
• Field of Search: 370/389, 370/252, 370/360, 370/363, 370/368, 370/371, 370/378, 370/381, 370/386, 370/395.31, 370/395.71, 370/395.7
• US Class Current: 370/389
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

Systems and methods are disclosed for analyzing network traffic data to generate complex statistics associated with the network traffic in real-time through parallel processing and data pipelining. In one implementation, a system includes a processor and a memory. The memory stores instructions that cause the processor to generate a plurality of program instances, wherein a first program instance observes the network traffic and uses a plurality of execution threads to distribute portions of the network traffic to additional program instances tasked with generating statistics associated with the network traffic. In other embodiments, a plurality of additional execution threads to the first program instance are tasked with generating the statistics. In either case, the generated statistics are placed into a data pipeline organized into time intervals of generated statistics, wherein the computation of higher-order statistics are computed as the lower-order time intervals are processed.

Claims

1. A computer-implemented method for analyzing network traffic, comprising:

observing network data packets associated with a network data stream using a first process;

performing operations on the data packets using a first thread of execution of the first process running a plurality of execution threads, comprising;

routing the data packets to a plurality of first shared memories based on predetermined routing rules,

removing the data packets stored in the plurality of first shared memories using additional threads from among the plurality of threads, each thread from among the plurality of threads dedicated to one of the plurality of first shared memories, and

storing the data packets to a plurality of second shared memories using the dedicated threads;

computing statistics associated with the data packets stored in the plurality of second shared memories; and

placing the computed statistics into a data pipeline, wherein the data pipeline stores the computed statistics according to time intervals, wherein the data pipeline comprises hierarchical levels of data structures associated with time intervals, the data structures of time intervals above the lowest-level comprising a predetermined number of data structures for the next-lower time interval.

2. The method of claim 1, wherein the network data packets are passively observed from a port dedicated to port mirroring.

3. The method of claim 1, wherein each of the plurality of first shared memories comprise a series of buffers forming amortized blocking queues, and each of the plurality of second shared memories comprise a series of buffers forming message queues.

4. The method of claim 1, wherein the predetermined routing rules are based on at least one of a network service, DNS request, type of DNS request, source network address, destination network address, transport layer port, or Top-Level Domain associated with the data packets.

5. The method of claim 1, wherein the predetermined routing rules are based on the processing capacity of threads of execution computing the statistics associated with the data packets.

6. The method of claim 1, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a plurality of second processes different than the first process.

7. The method of claim 1, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a second plurality of second execution threads of the first process.

8. The method of claim 1, further comprising:

placing the computed statistics into a data pipeline at data structures associated with the lowest-level time interval; and

merging the data structures associated with time intervals of the same level upon receipt of a predetermined number of data structures for the next-lower time interval.

9. A computer system for analyzing network traffic, comprising:

one or more processors; and

a memory system having instructions, that when executed by the one or more processors, cause the one or more processors to perform the operations of;

observing network data packets associated with a network data stream using a first process;

performing operations on the data packets using a first thread of execution of the first process running a plurality of execution threads, comprising;

routing the data packets to a plurality of first shared memories based on predetermined routing rules,

removing the data packets stored in the plurality of first shared memories using additional threads from among the plurality of threads, each thread from among the plurality of threads dedicated one of the plurality of first shared memories, and

storing the data packets to a plurality of second shared memories using the dedicated threads;

computing statistics associated with the data packets stored in the plurality of second shared memories; and

placing the computed statistics into a data pipeline, wherein the data pipeline stores the computed statistics according to time intervals, wherein the data pipeline comprises hierarchical levels of data structures associated with time intervals, the data structures of time intervals above the lowest-level comprising a predetermined number of data structures for the next-lower time interval.

10. The system of claim 9, wherein the network data packets are passively observed from a port dedicated to port mirroring.

11. The system of claim 9, wherein each of the plurality of first shared memories comprise a series of buffers forming amortized blocking queues, and each of the plurality of second shared memories comprise a series of buffers forming message queues.

12. The system of claim 9, wherein the predetermined routing rules are based on at least one of a network service, DNS request, type of DNS request, source network address, destination network address, transport layer port, or Top-Level Domain associated with the data packets.

13. The system of claim 9, wherein the predetermined routing rules are based on the processing capacity of threads of execution computing the statistics associated with the data packets.

14. The system of claim 9, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a plurality of second processes different than the first process.

15. The system of claim 9, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a second plurality of second execution threads of the first process.

16. The system of claim 9, wherein the operations performed by the one or more processors further comprise:

placing the computed statistics into a data pipeline at data structures associated with the lowest-level time interval; and

merging the data structures associated with time intervals of the same level upon receipt of a predetermined number of data structures for the next-lower time interval.

17. A non-transitory computer-readable medium storing instructions for analyzing network traffic, the instructions operable to cause one or more computer processors to perform operations, comprising:

observing network data packets associated with a network data stream using a first process;

performing operations on the data packets using a first thread of execution of the first process running a plurality of execution threads, comprising;

routing the data packets to a plurality of first shared memories based on predetermined routing rules,

removing the data packets stored in the plurality of first shared memories using additional threads from among the plurality of threads, each thread from among the plurality of threads dedicated to one of the plurality of first shared memories, and

storing the data packets to a plurality of second shared memories using the dedicated threads; and

computing statistics associated with the data packets stored in the plurality of second shared memories;

placing the computed statistics into a data pipeline, wherein the data pipeline stores the computed statistics according to time intervals, wherein the data pipeline comprises hierarchical levels of data structures associated with time intervals, the data structures of time intervals above the lowest-level comprising a predetermined number of data structures for the next-lower time interval.

18. The medium of claim 17, wherein the network data packets are passively observed from a port dedicated to port mirroring.

19. The medium of claim 17, wherein each of the plurality of first shared memories comprise a series of buffers forming amortized blocking queues, and each of the plurality of second shared memories comprise a series of buffers forming message queues.

20. The medium of claim 17, wherein the predetermined routing rules are based on at least one of a network service, DNS request, type of DNS request, source network address, destination network address, transport layer port, or Top-Level Domain associated with the data packets.

21. The medium of claim 17, wherein the predetermined routing rules are based on the processing capacity of threads of execution computing the statistics associated with the data packets.

22. The medium of claim 17, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a plurality of second processes different than the first process.

23. The medium of claim 17, wherein the statistics associated with the data packets stored in the plurality of second shared memories are computed using a second plurality of second execution threads of the first process.

24. The medium of claim 17, wherein the instructions are further operable to cause one or more computer processors to perform operations comprising:

placing the computed statistics into a data pipeline at data structures associated with the lowest-level time interval; and

merging the data structures associated with time intervals of the same level upon receipt of a predetermined number of data structures for the next-lower time interval.