Personalization of alerts based on network monitoring

• US 10,038,611 B1
• Filed: 02/08/2018
• Issued: 07/31/2018
• Est. Priority Date: 02/08/2018
• Status: Active Grant

• Current Assignee: ExtraHop Networks, Incorporated
• Original Assignee: ExtraHop Networks, Incorporated
• Inventors: Wu, Xue Jun, Braun, Nicholas Jordan, Deaguero, Joel Benjamin, Montague, Michael Kerber Krause, Khanal, Bhushan Prasad
• Primary Examiner(s): Osman, Ramy M
• Application Number:
  US15/892,327
• Time in Patent Office: 173 Days
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Abstract

Embodiments are directed to monitoring network traffic using network computers. A monitoring engine may monitor network traffic associated with a plurality of entities in a network to provide metrics. A device relation model may be provided based on the plurality of entities, the network traffic, and the metrics. Interest information for a user may be provided based on one or more properties associated with the user. An inference engine may associate each entity in the plurality of entities with an interest score based on the interest information, the device relation model, and the metrics. An alert engine may generate a plurality of alerts associated with the plurality of entities based on the metrics. Some of the alerts may be provided to the user based on ranked interest scores associated with the entities.

Claims

1. A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including;

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

providing interest information for a user based on one or more properties associated with the user;

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an interest score that is further associated with a level of interest to the user, wherein the level of interest is based on the interest information, the device relation model, and the one or more metrics; and

instantiating an alert engine to perform actions, including;

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics; and

providing one or more alerts to the user from the plurality of alerts based on one or more ranked interest scores associated with one or more entities.

2. The method of claim 1, wherein the inference engine performs further actions, comprising:

monitoring an amount of interactions by the user with the plurality of entities; and

increasing the interest score associated with each of the plurality of entities based on the monitored amount of user interactions.

3. The method of claim 1, wherein the inference engine performs further actions, comprising:

providing a list of entities to the user based on the interest information and the device relation model; and

modifying the interest score associated with one or more listed entities based on input by the user.

4. The method of claim 1, wherein the inference engine performs further actions, comprising:

traversing the device relation model based on the interest information;

providing one or more other entities based on the traversal; and

modifying the interest score that is associated with the one or more other entities based on the traversal.

5. The method of claim 1, wherein the actions of the inference engine further comprises, modifying the interest score of an entity based on one or more of applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of other users.

6. The method of claim 1, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more heuristics, wherein the one or more heuristics compare the one or more properties associated with the user to one or more user roles.

7. The method of claim 1, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on a distance between entities in the device relation model.

8. The method of claim 1, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more properties that are associated with the portion of the plurality of the entities.

9. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including;

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

providing interest information for a user based on one or more properties associated with the user;

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an interest score that is further associated with a level of interest to the user, wherein the level of interest is based on the interest information, the device relation model, and the one or more metrics; and

instantiating an alert engine to perform actions, including;

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics; and

providing one or more alerts to the user from the plurality of alerts based on one or more ranked interest scores associated with one or more entities.

10. The media of claim 9, wherein the inference engine performs further actions, comprising:

monitoring an amount of interactions by the user with the plurality of entities; and

increasing the interest score associated with each of the plurality of entities based on the monitored amount of user interactions.

11. The media of claim 9, wherein the inference engine performs further actions, comprising:

providing a list of entities to the user based on the interest information and the device relation model; and

modifying the interest score associated with one or more listed entities based on input by the user.

12. The media of claim 9, wherein the inference engine performs further actions, comprising:

traversing the device relation model based on the interest information;

providing one or more other entities based on the traversal; and

modifying the interest score that is associated with the one or more other entities based on the traversal.

13. The media of claim 9, wherein the actions of the inference engine further comprises, modifying the interest score of an entity based on one or more of applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of other users.

14. The media of claim 9, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more heuristics, wherein the one or more heuristics compare the one or more properties associated with the user to one or more user roles.

15. The media of claim 9, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on a distance between entities in the device relation model.

16. A system for monitoring network traffic in a network:

one or more network computers, comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a monitoring engine to perform actions, including;

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

providing interest information for a user based on one or more properties associated with the user;

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an interest score that is further associated with a level of interest to the user, wherein the level of interest is based on the interest information, the device relation model, and the one or more metrics; and

instantiating an alert engine to perform actions, including;

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics; and

providing one or more alerts to the user from the plurality of alerts based on one or more ranked interest scores associated with one or more entities, and

one or more client computers, comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

providing one or more portions of the network traffic.

17. The system of claim 16, wherein the inference engine performs further actions, comprising:

monitoring an amount of interactions by the user with the plurality of entities; and

increasing the interest score associated with each of the plurality of entities based on the monitored amount of user interactions.

18. The system of claim 16, wherein the inference engine performs further actions, comprising:

providing a list of entities to the user based on the interest information and the device relation model; and

modifying the interest score associated with one or more listed entities based on input by the user.

19. The system of claim 16, wherein the inference engine performs further actions, comprising:

traversing the device relation model based on the interest information;

providing one or more other entities based on the traversal; and

modifying the interest score that is associated with the one or more other entities based on the traversal.

20. The system of claim 16, wherein the actions of the inference engine further comprises, modifying the interest score of an entity based on one or more of applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of other users.

21. The system of claim 16, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more heuristics, wherein the one or more heuristics compare the one or more properties associated with the user to one or more user roles.

22. The system of claim 16, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on a distance between entities in the device relation model.

23. The system of claim 16, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more properties that are associated with the portion of the plurality of the entities.

24. A network computer for monitoring communication over a network between two or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a monitoring engine to perform actions, including;

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

providing interest information for a user based on one or more properties associated with the user;

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an interest score that is further associated with a level of interest to the user, wherein the level of interest is based on the interest information, the device relation model, and the one or more metrics; and

instantiating an alert engine to perform actions, including;

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics; and

providing one or more alerts to the user from the plurality of alerts based on one or more ranked interest scores associated with one or more entities.

25. The network computer of claim 24, wherein the inference engine performs further actions, comprising:

monitoring an amount of interactions by the user with the plurality of entities; and

increasing the interest score associated with each of the plurality of entities based on the monitored amount of user interactions.

26. The network computer of claim 24, wherein the inference engine performs further actions, comprising:

providing a list of entities to the user based on the interest information and the device relation model; and

modifying the interest score associated with one or more listed entities based on input by the user.

27. The network computer of claim 24, wherein the inference engine performs further actions, comprising:

traversing the device relation model based on the interest information;

providing one or more other entities based on the traversal; and

modifying the interest score that is associated with the one or more other entities based on the traversal.

28. The network computer of claim 24, wherein the actions of the inference engine further comprises, modifying the interest score of an entity based on one or more of applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of other users.

29. The network computer of claim 24, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on one or more heuristics, wherein the one or more heuristics compare the one or more properties associated with the user to one or more user roles.

30. The network computer of claim 24, wherein the actions of the inference engine further comprise, modifying the interest score that is associated a portion of the plurality of entities based on a distance between entities in the device relation model.