System and method for assigning network blocks to sensors

• US 9,110,905 B2
• Filed: 02/28/2013
• Issued: 08/18/2015
• Est. Priority Date: 06/11/2010
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Polley, Jonathan, Vogel, William Andrew III
• Primary Examiner(s): Fan, Hua
• Application Number:
  US13/779,851
• Publication Number:
  US 20130173790A1
• Time in Patent Office: 901 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies

Abstract

A system includes a processor device. The processor device is configured to detect a physical topology of a network comprising hosts and sensors in the network. The processor device is also configured to generate a sensor policy for assignment of the sensors to network blocks of the hosts, that balances a processing load and accuracy of the sensors in the network based on physical closeness of the sensors to different divisions of hosts within a same network block.

Claims

1. A computer system comprising:

a processor and memory configured to;

receive topology information of a network comprising a plurality of hosts and a plurality of sensors for monitoring hosts, the topology information indicating, for each host that each sensor has observed, a distance between the sensor and host;

divide the network into a plurality of network blocks, each network block comprising one or more hosts;

for each sensor, compute a score for each network block having at least one host that has been observed by the sensor, the score being based on distances between the sensor and the hosts within the network block that have been observed by the sensor;

for each network block, assign to the network block a shortest distance score from among the scores computed for the network block, the shortest distance score corresponding to a sensor having a shortest distance to the network block;

sum the shortest distance scores assigned to the network blocks and apply a scaling factor to the sum to produce a weighted sum of scores, wherein the scaling factor is based on a size of the network blocks and favors having a greater number of hosts per network block;

perform the divide, compute, assign, and sum operations a plurality of times with increasingly smaller network blocks having fewer hosts until a weighted sum of scores indicating a weighted overall shortest distance between sensors and hosts is determined; and

generate a sensor policy that assigns sensors to network blocks based on the weighted sum of scores indicating the weighted overall shortest distance between sensors and hosts.

2. The system of claim 1, wherein the processor is further configured to transmit the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

3. The system of claim 1, further comprising a user interface configured to display the sensor policy for assignment of the sensors.

4. The system of claim 1, wherein the processor is configured to divide the network into a plurality of network blocks using a netmask, wherein the size of the network blocks is determined by a length of the netmask.

5. The system of claim 1, wherein the distance between the sensor and host is based on a number of hops between the sensor and host.

6. The system of claim 1, wherein the scaling factor ranges from 80% to 100% based on the size of the network blocks.

7. A method comprising:

in a processor device;

receiving topology information of a network comprising a plurality of hosts and a plurality of sensors for monitoring hosts, the topology information indicating, for each host that each sensor has observed, a distance between the sensor and host;

dividing the network into a plurality of network blocks, each network block comprising one or more hosts;

for each sensor, computing a score for each network block having at least one host that has been observed by the sensor, the score being based on distances between the sensor and the hosts within the network block that have been observed by the sensor;

for each network block, assigning to the network block a shortest distance score from among the scores computed for the network block, the shortest distance score corresponding to a sensor having a shortest distance to the network block;

summing the shortest distance scores assigned to the network blocks and applying a scaling factor to the sum to produce a weighted sum of scores, wherein the scaling factor is based on a size of the network blocks and favors having a greater number of hosts per network block;

performing the dividing, computing, assigning, and summing operations a plurality of times with increasingly smaller network blocks having fewer hosts until a weighted sum of scores indicating a weighted overall shortest distance between sensors and hosts is determined; and

generating a sensor policy that assigns sensors to network blocks based on the weighted sum of scores indicating the weighted overall shortest distance between sensors and hosts.

8. The method of claim 7, further comprising transmitting the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

9. The method of claim 7, further comprising displaying the sensor policy for assignment of the sensors, on a display to a user for acceptance of the sensor policy.

10. A controller configured to perform the method of claim 7.

11. The method of claim 7, wherein dividing the network comprises dividing the network into a plurality of network blocks using a netmask, wherein the size of the network blocks is determined by a length of the netmask.

12. The method of claim 7, wherein the distance between the sensor and host is based on a number of hops between the sensor and host.

13. The method of claim 7, wherein the scaling factor ranges from 80% to 100% based on the size of the network blocks.

14. A non-transitory computer readable medium comprising executable instructions for performing the method of claim 7.

15. A non-transitory computer-readable storage medium comprising non-transitory computer-readable instructions for performing the steps of:

receiving topology information of a network comprising a plurality of hosts and a plurality of sensors for monitoring hosts, the topology information indicating, for each host that each sensor has observed, a distance between the sensor and host;

dividing the network into a plurality of network blocks, each network block comprising one or more hosts;

for each sensor, computing a score for each network block having at least one host that has been observed by the sensor, the score being based on distances between the sensor and the hosts within the network block that have been observed by the sensor;

for each network block, assigning to the network block a shortest distance score from among the scores computed for the network block, the shortest distance score corresponding to a sensor having a shortest distance to the network block;

summing the shortest distance scores assigned to the network blocks and applying a scaling factor to the sum to produce a weighted sum of scores, wherein the scaling factor is based on a size of the network blocks and favors having a greater number of hosts per network block;

performing the dividing, computing, assigning, and summing operations a plurality of times with increasingly smaller network blocks having fewer hosts until a weighted sum of scores indicating a weighted overall shortest distance between sensors and hosts is determined; and

generating a sensor policy that assigns sensors to network blocks based on the weighted sum of scores indicating the weighted overall shortest distance between sensors and hosts.

16. The non-transitory storage medium of claim 15, further comprising instructions for transmitting the sensor policy to the sensors in the network to instruct the sensors as to which hosts to monitor.

17. The non-transitory storage medium of claim 15, further comprising instructions for displaying the sensor policy for assignment of the sensors, on a display to a user for acceptance of the sensor policy.

18. The non-transitory storage medium of claim 15, wherein the instructions for dividing the network further comprise instructions for dividing the network into a plurality of network blocks using a netmask, wherein the size of the network blocks is determined by a length of the netmask.

19. The non-transitory storage medium of claim 15, wherein the distance between the sensor and host is based on a number of hops between the sensor and host.

20. The non-transitory storage medium of claim 15, wherein the scaling factor ranges from 80% to 100% based on the size of the network blocks.