Heuristics for determining the layout of a procedurally generated user interface

• US 9,300,554 B1
• Filed: 06/25/2015
• Issued: 03/29/2016
• Est. Priority Date: 06/25/2015
• Status: Active Grant

• Current Assignee: ExtraHop Networks, Incorporated
• Original Assignee: ExtraHop Networks, Incorporated
• Inventors: Kosai, Ryan Takeo, Birmingham, Alexander Clarke
• Primary Examiner(s): Wu, Jianye
• Application Number:
  US14/750,905
• Time in Patent Office: 278 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04845 for image manipulation, e.g. dragging, rotation, expansion or change of colour
• CPC Class Codes: G06F 40/186 Templates
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD). Measurement information may be generated based on network traffic that may be monitored by the NMD. Metrics associated with one or more characteristics of the monitored network traffic may be generated based on the measurement information. Layout information for a user-interface may be generated based on results of heuristics that use the measurement information. Generating the layout information may include, determining a layout template based on the results of the heuristics and the measurement information. Metric visualizations that may be associated with the metrics may be displayed in the user-interface based on the layout information. If measurements exceed defined threshold values, the layout information may be modified based on the changes to the measurement information. Accordingly, the layout of the user interface may be modified based on the modified layout information.

Claims

1. A method for monitoring communication over a network with a network monitoring device (NMD) that performs actions, comprising:

generating measurement information based on network traffic that is monitored by the NMD;

generating one or more metrics based on the measurement information, wherein the one or more metrics are associated with one or more characteristics of the monitored network traffic;

generating layout information for a user-interface based on one or more results of one or more heuristics, wherein the one or more results of the one or more heuristics are based in part on the measurement information;

providing one or more ranked positions in the user-interface to display one or more metric visualizations, wherein a rank for each of the one or more ranked positions is based on one or more of the measurement information or the one or more heuristics;

displaying the one or more metric visualizations in the user-interface based on the layout information that includes geometry information for the one or more ranked positions, wherein the one or more metric visualizations are associated with the one or more metrics; and

when one or more portions of the measurement information exceed one or more defined threshold values, performing further actions, including;

modifying the layout information based on the one or more portions of the measurement information and one or more other results of the one or more heuristics; and

modifying the display of the one or more metric visualizations based on the modified layout information.

2. The method of claim 1, further comprising:

modifying the measurement information to include one or more other characteristics of the network traffic, wherein the one or more other characteristics are associated with different Open Systems Interconnection (OSI) layers of the network traffic;

providing the modified measurement information to the one or more heuristics, wherein the one or more heuristics generate one or more correlations between different OSI layers based on the one or more other characteristics; and

updating the one or more results of the one or more heuristics based on the one or more correlations.

3. The method of claim 1, wherein the measurement information, further comprises, user interactions with the user-interface, wherein the user interactions include one or more of rearranging the layout of the one or more metric visualizations, hiding the one or more metric visualizations from view, sharing the one or more metric visualizations with other users, or printing hardcopies of the one or more metric visualizations.

4. The method of claim 1, wherein the measurement information, further comprises, one or more changes in a topology of the network, wherein changes in the topology of the network include one or more of one or more computers being added to the network, one or more computers leaving the network, or alterations to the network'"'"'s routing information.

5. The method of claim 1, wherein the one or more results of the one or more heuristics are generated by one or more of an expert system, a rules engine, a neural network, a deep learning neural network, a computer program, or configuration information.

6. The method of claim 1, further comprising, determining a position in the user interface for the one or more metric visualizations based on at least one of a relevancy score or a weight, wherein the relevancy score is determined in part by the one or more results of the one or more heuristics.

7. The method of claim 1, wherein generating the layout information further comprises, determining a layout template based on the one or more results of the one or more heuristics and the measurement information.

8. The method of claim 1, wherein generating the layout information further comprises employing geo-location information that is provided to the one or more heuristics.

9. A system for monitoring communication over a network, comprising:

a network monitoring device (NMD), comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

a processor device that executes instructions that perform actions, including;

generating measurement information based on network traffic that is monitored by the NMD;

generating one or more metrics based on the measurement information, wherein the one or more metrics are associated with one or more characteristics of the monitored network traffic;

generating layout information for a user-interface based on one or more results of one or more heuristics, wherein the one or more results of the one or more heuristics are based in part on the measurement information;

providing one or more ranked positions in the user-interface to display one or more metric visualizations, wherein a rank for each of the one or more ranked positions is based on one or more of the measurement information or the one or more heuristics;

displaying the one or more metric visualizations in the user-interface based on the layout information that includes geometry information for the one or more ranked positions, wherein the one or more metric visualizations are associated with the one or more metrics; and

when one or more portions of the measurement information exceed one or more defined threshold values, performing further actions, including;

modifying the layout information based on the one or more portions of the measurement information and one or more other results of the one or more heuristics; and

modifying the display of the one or more metric visualizations based on the modified layout information; and

a client computer, comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

a processor device that executes instructions that perform actions, including;

displaying the user interface that includes the one or more metric visualizations.

10. The system of claim 9, wherein the NMD processor device executes instructions that perform actions, further comprising:

modifying the measurement information to include one or more other characteristics of the network traffic, wherein the one or more other characteristics are associated with different Open Systems Interconnection (OSI) layers of the network traffic;

providing the modified measurement information to the one or more heuristics, wherein the one or more heuristics generate one or more correlations between different OSI layers based on the one or more other characteristics; and

updating the one or more results of the one or more heuristics based on the one or more correlations.

11. The system of claim 9, wherein the measurement information, further comprises, user interactions with the user-interface, wherein the user interactions include one or more of rearranging the layout of the one or more metric visualizations, hiding the one or more metric visualizations from view, sharing the one or more metric visualizations with other users, or printing hardcopies of the one or more metric visualizations.

12. The system of claim 9, wherein the measurement information, further comprises, one or more changes in a topology of the network, wherein changes in the topology of the network include one or more of one or more computers being added to the network, one or more computers leaving the network, or alterations to the network'"'"'s routing information.

13. The system of claim 9, wherein the one or more results of the one or more heuristics are generated by one or more of an expert system, a rules engine, a neural network, a deep learning neural network, a computer program, or configuration information.

14. The system of claim 9, wherein the NMD processor device executes instructions that perform actions, further comprising, determining a position in the user interface for the one or more metric visualizations based on at least one of a relevancy score or a weight, wherein the relevancy score is determined in part by the one or more results of the one or more heuristics.

15. The system of claim 9, wherein generating the layout information further comprises, determining a layout template based on the one or more results of the one or more heuristics and the measurement information.

16. The system of claim 9, wherein generating the layout information further comprises employing geo-location information that is provided to the one or more heuristics.

17. A processor readable non-transitory storage media that includes instructions for monitoring communication over a network, wherein execution of the instructions by a processor device performs actions, comprising:

generating measurement information based on network traffic that is monitored by a NMD;

generating one or more metrics based on the measurement information, wherein the one or more metrics are associated with one or more characteristics of the monitored network traffic;

generating layout information for a user-interface based on one or more results of one or more heuristics, wherein the one or more results of the one or more heuristics are based in part on the measurement information;

providing one or more ranked positions in the user-interface to display one or more metric visualizations, wherein a rank for each of the one or more ranked positions is based on one or more of the measurement information or the one or more heuristics;

displaying the one or more metric visualizations in the user-interface based on the layout information that includes geometry information for the one or more ranked positions, wherein the one or more metric visualizations are associated with the one or more metrics; and

when one or more portions of the measurement information exceed one or more defined threshold values, performing further actions, including;

modifying the layout information based on the one or more portions of the measurement information and one or more other results of the one or more heuristics; and

modifying the display of the one or more metric visualizations based on the modified layout information.

18. The media of claim 17, further comprising:

modifying the measurement information to include one or more other characteristics of the network traffic, wherein the one or more other characteristics are associated with different Open Systems Interconnection (OSI) layers of the network traffic;

providing the modified measurement information to the one or more heuristics, wherein the one or more heuristics generate one or more correlations between different OSI layers based on the one or more other characteristics; and

updating the one or more results of the one or more heuristics based on the one or more correlations.

19. The media of claim 17, wherein the measurement information, further comprises, user interactions with the user-interface, wherein the user interactions include one or more of rearranging the layout of the one or more metric visualizations, hiding the one or more metric visualizations from view, sharing the one or more metric visualizations with other users, or printing hardcopies of the one or more metric visualizations.

20. The media of claim 17, wherein the measurement information, further comprises, one or more changes in a topology of the network, wherein changes in the topology of the network include one or more of one or more computers being added to the network, one or more computers leaving the network, or alterations to the network'"'"'s routing information.

21. The media of claim 17, wherein the one or more results of the one or more heuristics are generated by one or more of an expert system, a rules engine, a neural network, a deep learning neural network, a computer program, or configuration information.

22. The media of claim 17, further comprising, determining a position in the user interface for the one or more metric visualizations based on at least one of a relevancy score or a weight, wherein the relevancy score is determined in part by the one or more results of the one or more heuristics.

23. The media of claim 17, wherein generating the layout information further comprises employing geo-location information that is provided to the one or more heuristics.

24. A network computer for monitoring communication over a network, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

a processor device that executes instructions that perform actions, including;

generating measurement information based on network traffic that is monitored by the network computer;

generating one or more metrics based on the measurement information, wherein the one or more metrics are associated with one or more characteristics of the monitored network traffic;

generating layout information for a user-interface based on one or more results of one or more heuristics, wherein the one or more results of the one or more heuristics are based in part on the measurement information;

providing one or more ranked positions in the user-interface to display one or more metric visualizations, wherein a rank for each of the one or more ranked positions is based on one or more of the measurement information or the one or more heuristics;

displaying the one or more metric visualizations in the user-interface based on the layout information that includes geometry information for the one or more ranked positions, wherein the one or more metric visualizations are associated with the one or more metrics; and

when one or more portions of the measurement information exceed one or more defined threshold values, performing further actions, including;

modifying the layout information based on the one or more portions of the measurement information and one or more other results of the one or more heuristics; and

modifying the display of the one or more metric visualizations based on the modified layout information.

25. The network computer of claim 24, wherein the processor device executes instructions that perform actions, further comprising:

modifying the measurement information to include one or more other characteristics of the network traffic, wherein the one or more other characteristics are associated with different Open Systems Interconnection (OSI) layers of the network traffic;

providing the modified measurement information to the one or more heuristics, wherein the one or more heuristics generate one or more correlations between different OSI layers based on the one or more other characteristics; and

updating the one or more results of the one or more heuristics based on the one or more correlations.

26. The network computer of claim 24, wherein the measurement information, further comprises, user interactions with the user-interface, wherein the user interactions include one or more of rearranging the layout of the one or more metric visualizations, hiding the one or more metric visualizations from view, sharing the one or more metric visualizations with other users, or printing hardcopies of the one or more metric visualizations.

27. The network computer of claim 24, wherein the measurement information, further comprises, one or more changes in a topology of the network, wherein changes in the topology of the network include one or more of one or more computers being added to the network, one or more computers leaving the network, or alterations to the network'"'"'s routing information.

28. The network computer of claim 24, wherein the one or more results of the one or more heuristics are generated by one or more of an expert system, a rules engine, a neural network, a deep learning neural network, a computer program, or configuration information.

29. The network computer of claim 24, wherein the processor device executes instructions that perform actions, further comprising, determining a position in the user interface for the one or more metric visualizations based on at least one of a relevancy score or a weight, wherein the relevancy score is determined in part by the one or more results of the one or more heuristics.

30. The network computer of claim 24, wherein generating the layout information further comprises employing geo-location information that is provided to the one or more heuristics.