Technologies for determining sensor placement and topology
First Claim
1. A method comprising:
- receiving, by a computing device, messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors;
identifying flows reported in the messages;
for each of the flows, generating a respective list of sensors that reported that flow; and
based on the respective list of sensors, inferring at least one of a respective placement of the sensors within the network and a topology of the sensors.
1 Assignment
0 Petitions
Accused Products
Abstract
Systems, methods, and computer-readable media for determining sensor placement and topology. In some embodiments, a system can receive messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors. Next, the system can identify flows reported in the messages and, for each of the flows, generate a respective list of sensors that reported that flow. Based on the respective list of sensors, the system can infer a respective placement of the sensors within the network and a topology of the sensors. For example, the system can determine that a first sensor is deployed in a virtual machine, a second sensor is deployed in a hypervisor hosting the virtual machine, and a third sensor is deployed in a network device configured to route traffic associated with the hypervisor.
-
Citations
20 Claims
-
1. A method comprising:
-
receiving, by a computing device, messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors; identifying flows reported in the messages; for each of the flows, generating a respective list of sensors that reported that flow; and based on the respective list of sensors, inferring at least one of a respective placement of the sensors within the network and a topology of the sensors. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A system comprising:
-
a processor; and a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising; receiving messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors; identifying flows reported in the messages; for each of the flows, generating a respective list of sensors that reported that flow; and based on the respective list of sensors, inferring at least one of a respective placement of the sensors within the network and a topology of the sensors. - View Dependent Claims (16, 17, 18, 19)
-
-
20. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising:
-
receiving, by a computing device, messages from sensors deployed around a network, each of the messages reporting a respective flow captured by a reporting sensor from the sensors; identifying flows reported in the messages; generating a plurality of respective lists of sensors for the flows, each of the plurality of respective lists of sensors identifying one or more respective sensors reporting a respective one of the flows; and based on the plurality of respective lists of sensors, inferring at least one of a respective placement of the sensors within the network and a topology of the sensors by; for each specific sensor in each respective list of sensors from the plurality of respective lists of sensors; identifying a respective set of other listed sensors comprising all sensors in the respective list of sensors excluding the specific sensor; generating a list of respective sets of other listed sensors, the list of respective sets comprising each respective set of other listed sensors identified for the specific sensor; determining a respective union of sensors in the list of respective sets; determining a respective intersection of sensors in the list of respective sets; computing a respective difference between the respective union and the respective intersection; identifying one or more front sensors corresponding to the respective intersection of sensors, the one or more front sensors comprising a first set of all sensors that can observe all flows from the specific sensor; and identifying one or more rear sensors corresponding to the respective difference, the one or more rear sensors comprising a second set of all sensors whose flows can also be observed by the specific sensor.
-
Specification