System and method for management of cloud-based systems

• US 9,172,591 B2
• Filed: 02/06/2013
• Issued: 10/27/2015
• Est. Priority Date: 02/06/2012
• Status: Active Grant

• Current Assignee: Deepfield Networks Inc. (Nokia Corporation)
• Original Assignee: Deepfield Networks Inc. (Nokia Corporation)
• Inventors: Eggleston, Joseph E., Labovitz, Craig H.
• Primary Examiner(s): NANO, SARGON N
• Application Number:
  US13/760,780
• Publication Number:
  US 20130204997A1
• Time in Patent Office: 993 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/508 based on type of value added network service under agreement
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

System and method for reporting usage of a network infrastructure includes obtaining a map that includes at least one flow-mapping that correlates a flow feature with a service and that correlates a flow feature with an endpoint type, wherein the endpoint types include at least a subscriber type and a service type; at a first computer, receiving flow telemetry of a network infrastructure, the flow telemetry representing at least the destination and source attributes for network traffic in the flow telemetry; categorizing the flow telemetry into at least a subscriber flow category based on the source and destination endpoint types of the traffic; for subscriber flow telemetry of a subscriber, processing the subscriber flow telemetry into at least one flow feature; identifying at least one service to attribute to at least a portion of the subscriber flow telemetry, the service identified through the processed flow feature and a flow-mapping.

Claims

1. A method for reporting usage of a network infrastructure comprising:

performing by one or more computers;

obtaining a map that includes at least one flow-mapping that correlates a flow feature with a service and that correlates a flow feature with an endpoint type, wherein the endpoint types include at least a subscriber type and a service type;

at a first computer, receiving flow telemetry of a network infrastructure, the flow telemetry representing at least the destination and source attributes for network traffic in the flow telemetry;

categorizing the flow telemetry into at least a subscriber flow category based on the source and destination endpoint types of the traffic;

for subscriber flow telemetry of a subscriber, processing the subscriber flow telemetry into at least one flow feature;

identifying at least one service to attribute to at least a portion of the subscriber flow telemetry, the service identified through the processed flow feature and a flow-mapping; and

wherein the map includes at least one flow-mapping that correlates a domain name to a service;

wherein processing the subscriber flow telemetry into at least one flow feature comprises identifying domain name service (DNS) recursive responses sent to the subscriber of a subscriber flow, a recursive response including at least a domain name query and component address;

identifying a first portion of flow telemetry from the subscriber to the component address; and

wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises identifying a service for the first portion of flow telemetry through the flow feature that correlates a domain name of the component address to a service.

2. The method of claim 1, wherein at least one flow feature in the map is an Internet protocol (IP) address of a network component.

3. The method of claim 2, wherein categorizing the flow telemetry into at least a subscriber flow category comprises consolidating duplicate flow telemetry.

4. The method of claim 1, wherein a first flow-mapping includes a content delivery network (CDN) component as a flow feature that correlates to a first service, and a second flow-mapping includes a shared CDN component as a flow feature that correlates to at least the first and a second service;

wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises, through the first flow-mapping, identifying the first service to attribute to a first portion of subscriber flow telemetry; and

if a second portion of subscriber flow telemetry is associated with the first portion of subscriber flow telemetry, identifying the first service to attribute to the second portion of the subscriber flow telemetry.

5. The method of claim 1, wherein processing the subscriber flow telemetry comprises tracking combinations of component use as a flow feature.

6. The method of claim 5, wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises limiting possible services through one processed flow feature and a flow-mapping.

7. The method of claim 5, wherein tracking combinations of component use comprises tracking substantially simultaneous component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating at least two components of simultaneous usage to a service.

8. The method of claim 5, wherein tracking combinations of component use comprises tracking a sequence of component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating a sequence of at least two components to a service.

9. The method of claim 5, wherein tracking combinations of component use comprises tracking proportions of component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating a usage proportion ranges of at least two components to a service.

10. The method of claim 6, wherein tracking combinations of component use comprises tracking a traffic profile of a component accessed by a subscriber, and limiting possible identified services to services correlated with flow feature of the traffic profile.

11. The method of claim 1, comprising compiling data on services attributed to portions of the flow telemetry;

and rendering the data in service analytics interface.

12. The method of claim 11, wherein obtaining a map comprises retrieving component addresses of services, and adding the component addresses to the map as flow features correlated to a service, and at a first client, automating traffic of a first service and adding service components identified in traffic of the first client as flow features correlated to the first service in the map.

13. A system comprising:

a memory;

one or more computers programmed to perform operations comprising;

obtaining a map that includes at least one flow-mapping that correlates a flow feature with a service and that correlates a flow feature with an endpoint type, wherein the endpoint types include at least a subscriber type and a service type;

at a first computer, receiving flow telemetry of a network infrastructure, the flow telemetry representing at least the destination and source attributes for network traffic in the flow telemetry;

categorizing the flow telemetry into at least a subscriber flow category based on the source and destination endpoint types of the traffic;

for subscriber flow telemetry of a subscriber, processing the subscriber flow telemetry into at least one flow feature;

identifying at least one service to attribute to at least a portion of the subscriber flow telemetry, the service identified through the processed flow feature and a flow-mapping; and

wherein the map includes at least one flow-mapping that correlates a domain name to a service;

wherein processing the subscriber flow telemetry into at least one flow feature comprises identifying domain name service (DNS) recursive responses sent to the subscriber of a subscriber flow, a recursive response including at least a domain name query and component address;

identifying a first portion of flow telemetry from the subscriber to the component address; and

wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises identifying a service for the first portion of flow telemetry through the flow feature that correlates a domain name of the component address to a service.

14. The system of claim 13, wherein at least one flow feature in the map is an Internet protocol (IP) address of a network component.

15. The system of claim 14, wherein categorizing the flow telemetry into at least a subscriber flow category comprises consolidating duplicate flow telemetry.

16. The system of claim 13, wherein a first flow-mapping includes a content delivery network (CDN) component as a flow feature that correlates to a first service, and a second flow-mapping includes a shared CDN component as a flow feature that correlates to at least the first and a second service;

wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises, through the first flow-mapping, identifying the first service to attribute to a first portion of subscriber flow telemetry; and

if a second portion of subscriber flow telemetry is associated with the first portion of subscriber flow telemetry, identifying the first service to attribute to the second portion of the subscriber flow telemetry.

17. The system of claim 13, wherein processing the subscriber flow telemetry comprises tracking combinations of component use as a flow feature.

18. The system of claim 17, wherein identifying at least one service to attribute to at least a portion of the subscriber flow telemetry comprises limiting possible services through one processed flow feature and a flow-mapping.

19. The system of claim 17, wherein tracking combinations of component use comprises tracking substantially simultaneous component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating at least two components of simultaneous usage to a service.

20. The system of claim 17, wherein tracking combinations of component use comprises tracking a sequence of component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating a sequence of at least two components to a service.

21. The system of claim 17, wherein tracking combinations of component use comprises tracking proportions of component usage by a subscriber, and wherein the identified service is identified through a flow-mapping correlating a usage proportion ranges of at least two components to a service.

22. The system of claim 17, wherein tracking combinations of component use comprises tracking a traffic profile of a component accessed by a subscriber, and limiting possible identified services to services correlated with flow feature of the traffic profile.

23. The system of claim 13, comprising compiling data on services attributed to portions of the flow telemetry;

and rendering the data in service analytics interface.

24. The system of claim 23, wherein obtaining a map comprises retrieving component addresses of services, and adding the component addresses to the map as flow features correlated to a service, and at a first client, automating traffic of a first service and adding service components identified in traffic of the first client as flow features correlated to the first service in the map.