Pre-processing framework component of distributed intelligence architectures

• US 9,667,501 B2
• Filed: 07/29/2013
• Issued: 05/30/2017
• Est. Priority Date: 02/05/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dasgupta, Sukrit, Mermoud, Grgory, Vasseur, Jean-Philippe
• Primary Examiner(s): Tran, Jimmy H
• Application Number:
  US13/953,113
• Publication Number:
  US 20140222729A1
• Time in Patent Office: 1,401 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/5016 based on statistics of service availability, e.g. in percentage or over a given time
• CPC Class Codes: H04L 43/091 Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/40 Support for services or applications

Abstract

In one embodiment, a state tracking engine (STE) defines one or more classes of elements that can be tracked in a network. A set of elements to track is determined from the one or more classes, and the set of elements is tracked in the network. Access to the tracked set of elements then provided via one or more corresponding application programming interfaces (APIs). In another embodiment, a metric computation engine (MCE) defines one or more network metrics to be tracked in the network. One or more tracked elements are received from the STE. The one or more network metrics are tracked in the network based on the received one or more tracked elements. Access to the tracked network metrics is then provided via one or more corresponding APIs.

Claims

1. A method, comprising:

selectively defining, at a state tracking engine (STE) of a network device, one or more classes of elements to track in a network based on at least network relevancy, the elements relating to one or more of;

system states, control traffic properties, and application traffic properties;

selectively determining a set of elements to track by the STE, the set of elements selected from the one or more classes based on which elements are relevant to the network device and policy considerations;

tracking, by the STE, the set of elements in the network; and

providing, by the STE, access to the tracked set of elements via one or more corresponding application programming interfaces (APIs); and

sending, from the STE, one or more tracked elements to a metric computation engine (MCE) to track one or more network metrics in the network based on the one or more tracked elements, combine one or more generic variables and one or more statistical functions with one or more classes of elements that can be tracked in the network from the one or more STEs to create a new network metric and generate a new API to track the new network metric in the network.

2. The method according to claim 1, wherein the one or more classes relate to one or more of:

routing, an application, security, and a link layer.

3. The method according to claim 2, wherein the routing class includes elements relating to one or more of:

protocol type, packet type, a traffic statistic, an IP address, type-length-value (TLV) data, and a flag.

4. The method according to claim 2, wherein the application class includes elements relating to one or more of:

a port number, a traffic statistic, and a transport protocol used in the network.

5. The method according to claim 1, further comprising:

observing an undefined property in the network that does not correspond to any of the defined elements; and

tracking the undefined property in the network.

6. The method according to claim 5, further comprising:

requesting classification of the undefined property; and

providing access to the tracked undefined property via a corresponding API.

7. The method according to claim 1, further comprising:

restricting the tracking of the set of elements to one or more specified classes or one or more specified elements.

8. The method according to claim 7, further comprising:

receiving a message specifying the one or more specified classes or the one or more specified elements from a field area router (FAR), a centralized management node, a learning machine, or a user.

9. The method according to claim 1, further comprising:

pushing the tracking of the set of elements to one or more distributed nodes in the network.

10. The method according to claim 9, further comprising:

receiving aggregated tracked elements from the one or more distributed nodes.

11. The method according to claim 9, further comprising:

receiving locally averaged tracked elements from the one or more distributed nodes.

12. The method according to claim 1, further comprising:

sending the tracked set of elements to a storage database.

13. A method, comprising:

selectively defining, by a metric computation engine (MCE) executing on a network device, one or more network metrics to be tracked at a pre-processing layer in a network based on at least network relevancy;

receiving, at the MCE, one or more tracked elements from one or more state tracking engines (STEs) in the network;

tracking, by the MCE, the one or more network metrics in the network based on the received one or more tracked elements;

providing, by the MCE, access to the tracked network metrics via one or more corresponding application programming interfaces (APIs);

combining, by the MCE, one or more generic variables and one or more statistical functions with one or more classes of elements that can be tracked in the network from the one or more STEs to create a new network metric; and

dynamically generating, on the fly, a new API to track the new network metric in the network.

14. The method according to claim 13, wherein:

the one or more generic variables include one or more of;

time, number, and rate, and

the one or more statistical functions include one or more of average, variance, and frequency.

15. The method according to claim 13, further comprising:

preventing unauthorized access to a particular network metric.

16. The method according to claim 13, further comprising:

providing access to a particular network metric to an application or a user.

17. A system, comprising:

a first processor configured to execute one or more STEs on a pre-processing layer, the STE configured to;

selectively define one or more classes of elements to track in a network based on at least network relevancy, the elements relating to one or more of;

system states, control traffic properties, and application traffic properties,

selectively determine a set of elements to track from the one or more classes based on which elements are relevant the network and policy considerations,

track the set of elements in the network, and

provide access to the tracked set of elements via one or more corresponding application programming interfaces (APIs); and

a second processor configured to execute an MCE at a pre-processing layer, the MCE configured to;

define one or more network metrics to be tracked in the network,

receive one or more tracked elements from the one or more STEs in the network,

track the one or more network metrics in the network based on the received one or more tracked elements,

provide access to the tracked network metrics via one or more corresponding APIs;

combining one or more generic variables and one or more statistical functions with one or more classes of elements that can be tracked in the network from the one or more STEs to create a new network metric; and

dynamically generating, on the fly, a new API to track the new network metric in the network.

18. The system according to claim 17, further comprising:

nodes in the network configured to track the set of elements and send the tracked elements to the STE.

19. The system according to claim 18, wherein the nodes are further configured to aggregate the tracked elements.

20. The system according to claim 18, wherein the nodes are further configured to locally average the tracked elements.

21. An apparatus, comprising:

one or more network interfaces that communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute a process; and

a memory configured to store program instructions which contain the process executable by the processor, the process comprising;

selectively defining, at an state tracking engine (STE) executing on the processor, one or more classes of elements to track in a network based on at least network relevancy, the elements relating to one or more of;

system states, control traffic properties, and application traffic properties;

selectively determining a set of elements by the STE to track from the one or more classes based on which elements are relevant the network and policy considerations;

tracking the set of elements in the network;

providing access to the tracked set of elements via one or more corresponding application programming interfaces (APIs); and

sending, from the STE, one or more tracked elements to a metric computation engine (MCE) to track one or more network metrics in the network based on the one or more tracked elements, combine one or more generic variables and one or more statistical functions with one or more classes of elements that can be tracked in the network from the one or more STEs to create a new network metric and generate a new API to track the new network metric in the network.

22. An apparatus, comprising:

one or more network interfaces that communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute a metric computation engine (MCE) process; and

a memory configured to store program instructions which contain the process executable by the processor, the process comprising;

selectively defining one or more network metrics to be tracked at a pre-processing layer in the network based on at least network relevancy;

receiving one or more tracked elements from one or more STEs in the network;

tracking the one or more network metrics in the network based on the received one or more tracked elements;

providing access to the tracked network metrics via one or more corresponding application programming interfaces (APIs); and

combining one or more generic variables and one or more statistical functions with one or more classes of elements that can be tracked in the network from the one or more STEs to create a new network metric; and

dynamically generating, on the fly, a new API to track the new network metric in the network.