Service dependency discovery in enterprise networks

• US 8,954,550 B2
• Filed: 02/13/2008
• Issued: 02/10/2015
• Est. Priority Date: 02/13/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Zhang, Ming, Chen, Xu, Bahl, Paramvir
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US12/030,284
• Publication Number:
  US 20090204696A1
• Time in Patent Office: 2,554 Days
• Field of Search: 709/223
• US Class Current: 709/223
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

The claimed subject matter provides systems and/or techniques that identify service dependencies in enterprise networks. The system can include devices that, based on received network data packets, identify packets with common five tuples, aggregate the identified packets to form transactions associated with individual hosts, and determine delay distributions between one or more services solicited from or in response to the individual hosts. Based on the delay distributions, the system differentiates between dependent service pairs and independent service pairs and thereafter assembles and outputs dependency graphs that include dependency relationships between services from the perspective of a client-side and a server-side.

Claims

1. A machine-implemented system configured to automatically effectuate and facilitate service dependency identification in enterprise networks, the machine-implemented system comprising:

a processor configured to;

identify, from network data packets, a related packet with source, destination, and protocol information similar to that of a previous packet;

aggregate the related packet with the previous packet to form a transaction associated with an individual host;

employ the transaction associated with the individual host to determine a delay distribution between one or more services associated with the individual host from a perspective of the individual host;

differentiate between a dependent service pair and an independent service pair by identifying one or more spikes in the delay distribution that meet a predefined condition; and

provide a probability density function dependency graph that includes dependency relationships between services based on the differentiation between the dependent service pair and the independent service pair.

2. The machine-implemented system of claim 1, wherein at least one of a SYN flag or a SYN-ACK flag without a preceding SYN is employed to indicate a start of the transaction, and at least one of a FIN flag or a RST flag is employed to indicate an end of the transaction.

3. The machine-implemented system of claim 1, wherein a sequence of contiguous packets received within a time-out period comprise the transaction.

4. The machine-implemented system of claim 1, wherein the delay distribution ascertained from the perspective of the individual host is combined with a delay distribution determined from a perspective of a second host, the individual host and the second host being configured to perform a similar local service.

5. The machine-implemented system of claim 1, wherein noise is eliminated from the delay distribution.

6. The machine-implemented system of claim 1, wherein spike analysis is performed based on thresholding.

7. The machine-implemented system of claim 1, wherein the source, destination, and protocol information includes one or more of a source internet protocol (IP) address, a source port number, a destination IP address, a destination port number and a protocol type.

8. The machine-implemented system of claim 1, wherein flow level information is stored in a global hash-table utilizing an index key determined from the source, destination, and protocol information.

9. The machine-implemented system of claim 1, wherein a determination of an actual service is made by comparing a frequency of requests received from a local end and a remote end of the transaction.

10. A method implemented implemented by a computing device for identifying service dependencies in an enterprise network, the method comprising:

in an enterprise network, identifying two or more related packets having related source, destination, and protocol information;

evaluating the related packets to ascertain a delay distribution between one or more services solicited from a first host associated with the related packets;

differentiating between dependent service pairs and independent service pairs by identifying one or more spikes in the delay distribution that meet a predefined condition; and

using information associated with the service pairs to construct a dependency graph that identifies service dependencies in the enterprise network.

11. The method of claim 10, further comprising parsing each packet utilizing a SYN flag or a SYN-ACK flag without a preceding SYN component to indicate a start of a transaction associated with the related packets.

12. The method of claim 10, further comprising parsing each packet utilizing a FIN or RST flag to identify an end of a transaction associated with the related packets.

13. The method of claim 10, further comprising aggregating the delay distribution ascertained from a perspective of the first host with a delay distribution ascertained from a perspective of a second host.

14. The method of claim 10, further comprising eliminating noise in the delay distribution.

15. The method of claim 10, further comprising identifying false positives introduced by periodic access by the first host to a service.

16. One or more computer storage devices storing computer-readable instructions that, when executed on a computing device, cause the computing device to perform operations comprising:

locating a related packet having source, destination, and protocol information similar to a previous packet;

associating the related packet with the previous packet to form a transaction associated with a first host;

ascertaining a probability distribution function indicative of delay between one or more services solicited from the first host;

differentiating between a dependent service pair and an independent service pair by identifying spikes in the probability distribution function meeting a predefined condition; and

providing a dependency graph that identifies service pair dependencies in an enterprise network based on the delay distribution.

17. The one or more computer storage devices of claim 16, further comprising associating a sequence of contiguous packets received within a time-out period to comprise the transaction.

18. The one or more computer storage devices of claim 16, further comprising eliminating false positives that compare a first half of the delay distribution with a second half of the delay distribution by detecting one or more spikes where a ratio of the first half of the delay distribution to the second half of the delay distribution exceeds a limit.

19. The one or more computer storage devices of claim 16, wherein the source, destination, and protocol information includes one or more of a source IP address, a source port number, a destination IP address, a destination port number and a protocol type.

20. The one or more computer storage devices of claim 16, further comprising aggregating the delay distribution associated with the first host with the delay distribution associated with a second host.