DATA LAYERING IN A NETWORK MANAGEMENT SYSTEM

• US 20190087296A1
• Filed: 09/21/2017
• Published: 03/21/2019
• Est. Priority Date: 09/21/2017
• Status: Active Grant

• Current Assignee: FireMon, LLC
• Original Assignee: FireMon, LLC
• Inventors: Tom, Darren C
• Granted Patent: US 10,353,792 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

Aspects of the present disclosure involve systems and methods for summarizing large amounts of data over time into one or more data layers. The systems and methods provide for storing data from a large data feed, which may include machine-sourced and human-sourced information, into one or more layers that are defined by layer parameters. A user of an interface may provide various parameters that define the portion or portions of the raw data feed to be included in the layer. With the received parameters, the system may analyze the raw data feed as it is received at the monitoring or collecting system to identify instances of data that match the received parameters. Through the system, data from a large raw data feed is searched and made available to a network administrator for easier management of the network without consuming vast network resources and administrator time.

Claims

1. A method for managing a network of computing devices, the method comprising:

receiving, through a user interface, a plurality of data layer parameters comprising identifications of network operation information and a start time for obtaining the network operation information;

collecting, at a collector component of a network management system, a raw data network information feed comprising machine sourced information from one or more devices of the network of computing devices and human sourced information from the one or more third party systems in communication with the network management system;

correlating a portion of the raw data network information feed with the identifications of network operation information and the start time of the received plurality of data layer parameters;

storing the portion of the raw data network information feed as a layer of network data in a storage device;

receiving a search query from a user of the network management system through the user interface, the search query comprising an indication of an aspect of the raw data network information stored as the layer of network data in the storage device;

accessing the layer of network data in the storage device based on the received search query to obtain a portion of the layer of network data corresponding to the search query; and

providing the portion of the layer of network data corresponding to the search query to the user of the network management system.

2. The method of claim 1 wherein the plurality of data layer parameters further comprises an external data service for processing the portion of the raw data network information of the layer of network data, the method further comprising:

transmitting the portion of the raw data network information to the external data service.

3. The method of claim 2 further comprising:

receiving a resulting data information from the external data service; and

storing the resulting data information in the layer of network data in the storage device.

4. The method of claim 3 wherein the portion of the raw data network information of the layer of network data comprises Internet Protocol (IP) addresses associated with requests for access to a network device of the network of computing devices and the external data service is an IP address reputation service.

5. The method of claim 1 wherein the plurality of data layer parameters further comprises a stop time for obtaining the network operation information, the method further comprising:

stopping the storing of the portion of the raw data network information feed of the layer of network data at the stop time.

6. The method of claim 5 wherein the start time for obtaining the network operation information is a first date and the stop time for obtaining the network operation information is a second date different than the first date.

7. The method of claim 1 wherein the portion of the raw data network information of the layer of network data comprises a first number of network events, the first number of network events being less than a number of network events in a group of stored raw data network information.

8. The method of claim 7 wherein the number of network events in a group of stored raw data network information corresponds to received network events occurring from a raw data block beginning time to a raw data block end time, the number of network events corresponding to an amount of raw data manageable by a database of a network management system.

9. The method of claim 8 wherein the portion of the raw data network information of the layer of the network data occurs between the raw data block beginning time and the raw data block end time.

10. The method of claim 7 wherein the plurality of data layer parameters further comprises a time-to-live (TTL) value that defines a time limit for storing the portion of the raw data network information as the layer of network data in the storage device.

11. The method of claim 10 wherein the TTL value of the plurality of data layer parameters is longer than a TTL value for the group of stored raw data network information.

12. The method of claim 1 wherein the plurality of data layer parameters is received through the user interface from a network maintenance system comprising at least one network monitoring device.

13. The method of claim 1 wherein storing the portion of the raw data network information feed as a layer of network data in a storage device comprises storing a copy of the portion of the raw data network information feed as the layer of network data.

14. A system for managing a computer network, the system comprising:

a communication port for communication with one or more devices of the computer network and one or more third party systems;

a collector component receiving a raw data network information feed comprising machine sourced information from the one or more devices of the computer network and human sourced information from the one or more third party systems;

a database storing the raw data network information feed in a first number of network event blocks; and

a computing device executing a user interface application, the computing device;

receiving, through the user interface, a plurality of data layer parameters comprising identifications of network operation information and a start time for obtaining the network operation information;

correlating a portion of the raw data network information feed with the identifications of network operation information and the start time of the received plurality of data layer parameters into a layer of network data;

receiving a search query from a user of the computing device, the search query comprising an indication of an aspect of the layer of network data;

accessing the layer of network data based on the received search query to obtain a portion of the layer of network data corresponding to the search query; and

providing the portion of the layer of network data corresponding to the search query to the user of the network management system through the user interface.

15. The system of claim 14 wherein the plurality of data layer parameters further comprises an external data service for processing the portion of the raw data network information of the layer of network data, the computing device further:

transmitting the portion of the raw data network information to the external data service.

16. The system of claim 15 wherein the computing device further:

receiving a resulting data information from the external data service; and

correlating the resulting data information from the external data service in the layer of network data.

17. The system of claim 16 wherein the portion of the raw data network information of the layer of network data comprises Internet Protocol (IP) addresses associated with requests for access to a network device of the network of computing devices and the external data service is an IP address reputation service.

18. The system of claim 14 wherein the portion of the raw data network information of the layer of network data comprises a second number of network events, the second number of network events being less than the first number of network event blocks of the stored raw data network information.

19. The system of claim 18 wherein the first number of network events of the stored raw data network information corresponds to received network events occurring from a raw data block beginning time to a raw data block end time, the first number of network events corresponding to an amount of raw data manageable by the database.

20. The system of claim 19 wherein the portion of the raw data network information of the layer of the network data occurs between the raw data block beginning time and the raw data block end time.

21. The system of claim 16 wherein the plurality of data layer parameters further comprises a time-to-live (TTL) value that defines a time limit for storing the portion of the raw data network information as the layer of network data in the database.

22. The system of claim 21 wherein the TTL value of the plurality of data layer parameters is longer than a TTL value for the first number of network event blocks of the stored raw data network information.

23. The system of claim 14 wherein the plurality of data layer parameters is received through the user interface from a network maintenance system comprising at least one network monitoring device.

24. The system of claim 14 further comprising a display device displaying the portion of the layer of network data corresponding to the search query to the user of the network management system through the user interface.