Scalable hierarchical data automation in the network

Abstract

Techniques for deploying data services in a centrally managed network in a scalable hierarchical manner are described. An example method generally includes generating a topology description of a centrally managed network, the topology description identifying network entities in the centrally managed network and connections between network entities in the network. A data management hierarchy for the centrally managed network may be generated based on the topology description of the centrally managed network, and the data management hierarchy may identify network entities at which data services may be deployed in the centrally managed network. Data services and data rules may be deployed to the identified network entities based on the data management hierarchy, and data in the centrally managed network may be processed by the deployed data services.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Patent Application Serial No. 62 / 858,843, entitled “Scalable Hierarchical Data Automation in a Network,” filed on June 6, 2019, and assigned to its assignee, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] Embodiments presented in the present disclosure generally relate to data analysis systems for managing networks and managing the performance of these networks. More specifically, embodiments disclosed herein relate to layered deployment of data services on various network entities in a network to offload processing of network data to various network entities in the network to facilitate scalable data processing in the network. Background Art

[0004] A network may typically be configured by a variety of network elements such as routers, switches, access points, etc. In some cases, these network elements may be organized in a hierarchical manner, wherein a central network entity in a software defined network (SDN) configures and manages other network entities in the network. When configuring and managing other network entities in the network, the central network entity may include various analytical tools that ingest and analyze data in real time to facilitate network management and performance management.

[0005] The network entities in the SDN can generate a large amount of data for the central network entity to analyze. Due to the large amount of data generated within the SDN and the computing power required to process this data in real time, the central network entity can be limited to managing a limited number of endpoint devices in the SDN (e.g., desktops, laptops, mobile phones, tablets, servers, etc.). However, this limited number of endpoint devices may be less than the number of endpoint devices deployed in the organization. In addition, with the advent of IoT devices, more devices may become endpoint devices within the SDN. For example, lighting devices, sensors, heating, ventilation, and air conditioning (HVAC) equipment, household appliances, and other connected devices may be called endpoints in the SDN. Each of these devices can generate additional data for analysis by the central network entity, which may further exacerbate the scalability problem of managing the network through a central network entity that has the ability to manage a limited number of endpoint devices in the SDN. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In order to be able to understand in detail the manner in which the above-mentioned features of the present disclosure are achieved, a more specific description of the present disclosure briefly summarized above may be made by reference to embodiments, some of which are shown in the accompanying drawings. However, it should be noted that the accompanying drawings show typical embodiments and therefore should not be considered restrictive; other equivalent embodiments are also contemplated.

[0007] Figure 1 A network according to one embodiment is shown.

[0008] Figure 2 A hierarchical data analytics hierarchy generated for a network and used to distribute and deploy data services to network entities in the network is shown according to one embodiment.

[0009] Figure 3 An example central analysis engine of a central network entity for managing deployment of data services within a network is shown according to one embodiment.

[0010] Figure 4 An example network entity is shown having one or more data services deployed thereon by a central network entity according to one embodiment.

[0011] Figure 5 is a flow chart outlining general operations for discovering a network topology and allocating data services within a network based on the discovered network topology according to embodiments described herein.

[0012] Figure 6 is a flow chart outlining general operations for configuring a distributed data service at a network entity within a network according to embodiments described herein.

[0013] To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements disclosed in one embodiment may be beneficially utilized on other embodiments without specific recitation. DETAILED DESCRIPTION

[0014] Overview

[0015] Some aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applicable to various aspects alone or in combination with other aspects.

[0016] Embodiments described herein provide a method for deploying data services in a centrally managed network. To deploy data services in a centrally managed network, a topology description of the centrally managed network may be generated. The topology description may identify network entities in the centrally managed network and connections between network entities in the centrally managed network. A data management hierarchy for the centrally managed network may be generated based on the topology description of the centrally managed network. The data management hierarchy may identify one or more network entities in the centrally managed network, at which data services may be deployed. Data services and data rules may be deployed to the identified one or more network entities based on the data management hierarchy, and data may be processed in the centrally managed network through the deployed data services.

[0017] Example Embodiments

[0018] A system of one or more computers may be configured to perform specific operations or actions by installing software, firmware, hardware, or a combination thereof on the system, which in operation enables or causes the system to perform actions. One or more computer programs may be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, enable the device to perform actions. A general aspect includes a method for allocating data services in a network based on the topology of the network to provide scalable network management in a network with a large number of connected endpoint devices. Various data services may be deployed between network entities in the network based on a digital twin of the network topology, which identifies network entities in which various data services such as message brokers, data aggregators, data normalizers, etc. may be deployed to utilize the computing resources available at each network entity and the data generated by the endpoints attached to each network entity. The central network entity and other network entities in the network may process data through deployed and configured data services. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the respective actions of the method.

[0019] In general, by configuring a network to distribute data processing services among multiple network entities in the network, the processing overhead for ingesting and analyzing data within the network can be distributed among different network entities rather than being performed by a single network entity (e.g., a central network entity). The central network entity can obtain information from network entities in the network on a regular or irregular basis and use the obtained information to manage the network and manage the performance of the network. The data obtained by the central network entity can be pre-processed (e.g., aggregated, normalized, deduplicated, etc.) by other network entities in the network to reduce the processing overhead at the central network entity and utilize the processing capabilities of the network entities in the network. In addition, data storage devices can be distributed among network entities, thereby allowing temporary or permanent storage of raw data between different network entities in the network.

[0020] As described above, a software-defined network typically includes a central network entity that manages other network entities in the network. When managing network entities in the network, a large amount of data may be generated and used in real time to identify problems within the network (e.g., performance degradation, disconnection, malicious activity, etc.) and perform intent-based actions within the network (e.g., allowing or not allowing a connection to or between given endpoints, limiting threats within the network, etc.). Since the software-defined network includes various network entities organized in a topological hierarchy, information about the location of each network entity in the hierarchy, as well as information about the processing capabilities and other operational attributes of each network entity, can be used to identify locations where various services can be deployed in the software-defined network. A network entity can act as a repository for time series data, a data aggregator for aggregating and analyzing data from multiple network entities, a data normalizer for organizing data between networks, etc., so that various data analysis operations can be performed using the computing resources of the entire network rather than the computing resources of a single entity within the network (e.g., a central network entity, such as a centralized network manager).

[0021] Figure 1 An example network 100 according to one embodiment is shown. As shown, the network 100 includes a central network entity 110 and a plurality of network entities 1201-1208. In some examples, the network entities 1201-1208 may include various network infrastructure components such as switches, routers, access points, etc. that allow other devices such as various endpoint devices to connect to the network 100 through one or more network entities 120 in the network 100.

[0022] As shown, the central network entity 110 includes a central analysis engine 112. The central analysis engine 112 generally discovers the topology of the network 100 and uses the discovered topology of the network 100 to deploy various data services to the network entities 110 in the network to distribute data processing operations for analyzing data generated within the network 100 to manage the network 100. The central analysis engine 112 traverses the network to identify each network entity 120 and an endpoint device that is a component of the network 100, thereby discovering the topology of the network 100. For example, in Figure 1 , central network entity 110 may identify that network entities 1201 and 1202 are connected to central network entity 110. Central network entity 110 may then examine network entities 1201 and 1202, respectively, to identify network entities and endpoints connected to network entities 1201 and 1202. In network 100, central network entity 110 may therefore determine that network entities 1203 and 1204 are connected to network entity 1201 and network entities 1205 and 1206 are connected to network entity 1202. Central analysis engine 112 may continue to examine each discovered network entity against other network entities in network 100 until central network entity 110 has discovered each network entity 120 in network 100 (e.g., as shown in FIG. 1 ). Figure 1 until network entities 1207 and 1208 are discovered).

[0023] Using the discovered topology of the network 100, the central analysis engine 112 examines the network elements, connected endpoints, and expected data flows from the endpoints to generate a distributed data management hierarchy for the network 100. The distributed data management hierarchy generally represents the relationships between different network entities in the network 100 and the hardware and software capabilities of each network entity 120 in the network 100. The distributed data management hierarchy can be used to identify network entities 120 in the network 100 where various data services are deployed, as will be discussed in more detail below.

[0024] In generating the distributed data management hierarchy, the central analysis engine 112 identifies various attributes of the network 100, including the location of data sources (e.g., network elements that generate data that is typically provided to the network data platform), natural data aggregation points in the network, network entities that participate in possible east-west data flows (i.e., communications within a virtual network that spans multiple network entities), and computing resources available at each network entity 120. Identification of data aggregation points can identify network entities within the network that may be network entities that may deploy data message broker services. Information about the computing resources available at each network entity can be used to identify the capabilities of each network entity to host various services such as message broker services, time series databases, perform data normalization, analysis, learning or processing tasks, etc.

[0025] For example, a small switch with limited storage capabilities may not be able to host a time series database, but may be suitable for hosting a data message broker service. In another example, information about resource utilization at each network entity 120 may also be used to generate a data management hierarchy. It can be assumed that network entities 120 deployed in a scenario where resources are requested on a consistent basis have a relatively consistent amount of available resources. Therefore, services with expected resource utilization within the amount of available resources at a network entity 120 with a consistent amount of available resources can be deployed to the network entity. However, if the network entity 120 has a highly variable resource utilization, the central analysis engine 112 may not assume that the available resources of the network entity 120 exceed the resources available during peak utilization at any given time. Therefore, the central analysis engine 112 can use the peak utilization of the network entity to determine which services can be deployed to the network entity 120.

[0026] In some embodiments, to determine the capabilities of each network entity 120 within the network 100, the central analysis engine 112 may perform simulations to identify where endpoint devices are located and how these endpoint devices are connected to the network 100. The simulations may also include simulating data messages in the control plane of the network 100 to identify messages that the central network entity 110 is sending to manage the network 100. These messages need not be actual network traffic that will be generated by the endpoint devices in the network 100, but may be data messages that describe the structure of the network 100 and the actions performed to manage the network 100. By monitoring the simulated data messages in the control plane of the network 100, the central analysis engine may determine the relationships between different components in the network 100 and the locations in the network 100 that are used to tag data generated within the network 100.

[0027] In some embodiments, the distributed data management hierarchy may define a flexible hierarchical structure in which each node corresponding to a network entity may have possible data assignments along a range of possible values. In general, the distributed data management hierarchy may identify higher performance network entities 120 as entities that may perform more computationally expensive tasks, such as complex data normalization and data labeling. In contrast, lower performance network entities 120 (e.g., network entities with limited computational resources or with limited spare available computational resources) may be identified within the distributed data management hierarchy as being able to perform computationally less expensive tasks, such as forwarding collected data to a higher performance network entity 120 configured to aggregate data from other network entities 120 for processing.

[0028] After the central analysis engine 112 generates the distributed data management hierarchy, the central analysis engine 112 may deploy the data management service as a service 122 executed on one or more network entities 120 within the network 100, and coordinate the execution of the service 122 based on the distributed data management hierarchy. As discussed above, the services 122 deployed on network entities 120 with limited processing power or limited excess computing resources may be lightweight services that can be executed on these network entities 120 without adversely affecting the performance of these network entities 120. For example, the services 122 deployed on network entities 120 with limited processing power may perform data brokering (or aggregation) and messaging functions. These services 122 may aggregate data from various other network entities 120 in the network 100 and provide the data to another network entity 120 for further processing. In contrast, the services 122 deployed on network entities with greater processing power or excess computing resources may perform computationally more expensive or complex operations (e.g., data normalization and data deduplication, data analysis, etc.) on the data generated within the network 100.

[0029] In one example, consider a switch stack for massively parallel processing, where n switches serve as network entities 120. The central analysis engine 112 can configure the n network entities 120 to act as a distributed database spread out among the n network entities 120, where one network entity 1201 acts as a master node and the other network entities 1202-120 n Acting as a slave node where various data storage operations can be distributed in parallel. In this deployment, the data storage service can be distributed to the switch stack in a shared-nothing architecture. Queries to the distributed database can be processed by network entity 1201 (e.g., a network entity acting as a master node) and routed to slave nodes storing data (e.g., network entities 1202-120 n In some embodiments, another network entity (switch) in the switch stack may be configured as a backup primary switch that can take over from network entity 1201 to process queries to the distributed database when network entity 1201 fails or is otherwise removed from the switch stack.

[0030] After the data services are deployed between the network entities 120 in the network 100, the central analysis engine 112 may create and deploy data ingestion and normalization rules for the data services 122 deployed on the network entities 120. The data ingestion and normalization rules may be deployed so that the data services 122 deployed on the network entities 120 clean the data generated and aggregated at the network entities 120 before providing the data to the central analysis engine 112 for analysis. To configure data ingestion and normalization at each network entity 120 hosting the services 122, the central network entity identifies the data sources within the network 100 and the points at which data from these data sources may be aggregated and processed to remove redundant and / or noisy data from the data sets. In some embodiments, the data services 122 deployed on the network entities 120 may also be configured to generate summary data reports for transmission to the central analysis engine 112 for analysis, while retaining the original data on which these summary reports are generated on one or more local time series databases. The original data may be stored so that the central analysis engine 112 can reference the original data as needed.

[0031] In some embodiments, a context-aware data graph may be created at each network entity 120 and may be shared with the central analysis engine 112 to be combined into a global graph. The global graph typically contains multiple layers, where each layer represents a type of data flow and identifies where the data is aggregated and processed. In some embodiments, the aggregation of data may be distributed among various network entities 120, such that some types of data are aggregated at a first node, while other types of data are aggregated at other nodes, to avoid saturating network entities with data aggregation processes, which may cumulatively adversely affect the performance of these network entities.

[0032] In some embodiments, configuration of data ingestion and normalization rules for data services 122 deployed on network entities 120 may also include allocating various data processing and analysis operations to network entities 120 in network 100. For example, the distributed data management hierarchy may identify network entities 120 that include specific hardware components (e.g., graphics processing units, tensor processing units, field programmable gate arrays (FPGAs), etc.) that may be used for various machine learning operations. If network 100 includes network entities 120 with such hardware components that may be used to perform various machine learning or deep learning operations, the machine learning operations may be redirected from resources in a cloud computing environment to network entities 120 within the centrally managed network 100. These network entities 120 may be configured to perform various machine learning or deep learning operations on data generated within network 100. For example, these network entities 120 may be configured to learn the difference between normal and abnormal behavior within network 100, for example. Network entity 120 may use supervised learning techniques to learn the difference between normal behavior and abnormal behavior, and may use the learned difference to identify a type of abnormal behavior represented by data generated within network 100, such as malicious activity or non-malicious traffic spikes.

[0033] In another example, the service 122 may be configured to report information derived from raw data generated within the network 100. Since data operations may be distributed among the network entities 120 within the network 100 to reduce the amount of data processing operations performed at the central network entity 110, the service 122 may be configured to retain the raw data from which some other information may be calculated, and provide the calculated information (e.g., periodically or aperiodically) to the central analysis engine 112. For example, consider a voice or real-time video system (e.g., voice over Internet Protocol or VOIP) in which jitter (e.g., variation in packet delay) is measured and monitored. Generally speaking, calculating jitter requires comparing the real-time protocol (RTP) timestamp of each packet with the timestamp of the previous packet to generate a value representing the inter-packet delay between different packets. Jitter calculation may be a computationally intensive process because state information may need to be maintained for each packet in a given flow and calculations may be performed packet by packet. For example, if a given voice call uses a rate of 50 packets per second, 3000 data values ​​may be calculated per minute. To avoid overloading the central analysis engine 112 with raw data and generating a large amount of network traffic within the network 100, the service 122 can be configured to monitor and analyze packet jitter locally and periodically report the data to the central analysis engine 112. The reported data can include, for example, the minimum, maximum, and median values ​​of packet jitter over a given time period, which can reduce the amount of traffic generated for jitter analysis to three data points that are reported periodically.

[0034] Although the services 122 may be configured to report information derived or calculated from raw data generated within the network 100, the raw data upon which the reported information is based may be of interest for further analysis of the reported data. To facilitate analysis of the raw data and allow the central analysis engine 112 to view detailed status information about any client in the network 100 at any given point in time, the raw data may be retained at one or more network entities 120 for some time. The central analysis engine 112 may access the raw data on demand to facilitate, for example, real-time troubleshooting of problems discovered within the network 100. However, due to storage limitations of the network entities 120 within the network 100 (e.g., storage limitations of different computing devices or containers hosting the network entities 120), the raw data may be transferred to a central repository or data lake to avoid data loss. Therefore, each network entity 120 may be configured to upload the raw data captured at the network entity 120 to a central repository or data lake based on, for example, the expected activity at each network entity and the amount of data that the network entity 120 can retain without losing data. Data upload from the network entity 120 to the central repository or data lake can be configured so that data upload at the network entity 120 does not conflict with peak network load. In some cases where the network entity 120 does not have sufficient capacity to retain the original data before off-peak times, the network entity can be configured to upload the original data at more frequent periodic intervals. In some embodiments, the upload can be performed when the network entity 120 is not too busy and is postponed when the network entity is servicing an endpoint device. For example, consider the VOIP application discussed above. Since a large number of packets may be received at the network entity for a VOIP call, uploading the original data about each packet may incur bandwidth overhead, which may degrade the VOIP application. In order to minimize the impact on applications executed within the network 100, in the spirit of reducing the demand on the network entity 120 and the network 100, the original data for the VOIP call can be uploaded after the VOIP call is completed.

[0035] In general, the network entity 120 can be configured to intelligently upload raw data based on a variety of factors. These factors may include, but are not limited to, whether the central analysis engine 112 has requested the data, current memory and storage utilization at the network entity 120, current processor utilization at the network entity 120, bandwidth availability within the network 100, etc.

[0036] In some embodiments, the central analysis engine 112 may periodically or aperiodically update the discovered topology of the network 100 and the distributed data management hierarchy to identify changes in the network 100, such as the addition of new network entities 120 or the removal of existing network entities 120, changes in resource availability of existing network entities 120, etc. Based on the discovered changes, the central analysis engine 112 may reallocate data services among different network entities 120 in the network 100 based on the updated distributed data management hierarchy. By periodically or aperiodically redistributing data services based on the updated distributed data management hierarchy, the central network entity 110 may capture data generated by newly added network entities 120 in the network 100 and distribute the execution of various computationally expensive tasks to network entities 120 that have sufficient available computing resources and away from network entities 120 that have insufficient computing resources or that intermittently have sufficient computing resources.

[0037] Figure 2 According to one embodiment, Figure 1 The topology of the illustrated network 100 generates an example distributed data management hierarchy 200. As shown, the distributed data management hierarchy 200 includes a central network entity message broker 210, a plurality of message brokers 220, and a plurality of time series databases 230.

[0038] The central network entity message agent 210 generally represents a data service located at the root of the distributed data management hierarchy 200 and corresponds to a data service that may be deployed on the central network entity 110 to aggregate data from each network entity 120 in the network 100. In some embodiments, the central network entity message agent 210 may also be configured to periodically or aperiodically receive aggregated data from one or more message agents 220 deployed on network entities 120 within the network 100 and perform various analyses on the aggregated data. If the central network entity message agent 210 determines that the aggregated data indicates that there is a situation within the network 100 that requires further investigation, the central network entity message agent 210 may use a global data graph generated from the local data graph of each network entity 120 to identify a storage location of information of interest when investigating the situation in the network. When the central network entity message agent 210 identifies a storage location of information of interest (e.g., a specific network entity 120 storing the information), the central network entity message agent 210 may query a time series database 230 associated with the identified location to obtain raw network data for further analysis.

[0039] Each of the plurality of message brokers 220 may represent a data service deployed at various network entities 120 within the network 100. These message brokers 220 may expose data aggregation, normalization, and processing services that are configured based on the computing resources available at each network entity 120 and the identified locations where data can be aggregated, and determined according to the topology of the network 100 generated by the central network entity 110. In general, the message brokers 220 located at some nodes may represent services configured to aggregate raw data received from various other network entities and forward the collected raw data to upstream message brokers in a distributed hierarchy for further processing. Message brokers deployed on network entities 120 with greater computing resources (e.g., more powerful processors, additional random access memory or storage space, and / or dedicated hardware on which machine learning operations can be deployed and executed) may perform more complex, computationally expensive processes. For example, message brokers deployed on network entities 120 with greater computing resources may perform various calculations (e.g., the above-mentioned VOIP packet jitter calculations), data deduplication, etc. in real time.

[0040] The time series database 230 generally represents a data storage device in which time series information can be stored for retrieval by the central analysis engine 112. As discussed, the time series database 230 can be deployed on a network entity with a sufficient amount of random access memory and storage space to store a certain amount of raw data, and respond to requests for raw data from the central analysis engine 112 in a high-performance manner. In some embodiments, the time series database 230 can also be configured to refresh the data stored in the time series database periodically or on a rolling basis. The data can be refreshed from the time series database 230 and submitted to the data storage device at the central network entity 110, so that the raw data can be used for further investigation in the future. As discussed, the time series database 230 can be refreshed according to a schedule that takes into account the peak traffic load time at the network entity 120, the amount of computing resources available at the network entity 120 at any given time, etc. Based on these properties of each network entity 120 hosting a time series database, data from the time series database 230 can be submitted to a centralized data store or data lake at times outside of peak load times, and can be submitted according to a schedule that minimizes the risk of losing raw data generated by any given network entity 120.

[0041] As shown, the data management hierarchy 200 includes a first layer of message agents (e.g., message agents 2201 and 2202) below the central network entity message agent 210. The message agents 2201 and 2202 can aggregate data received from the message agent 220 located in the layer below the first layer of message agents in the data management hierarchy 200. Figure 2 As shown in , message agent 2201 can aggregate and process data received from message agents 2203 and 2204, while message agent 2202 can aggregate and process data received from message agents 2205 and 2206.

[0042] As shown, each of the message brokers 2203, 2204, 2205, and 2206 can be connected to a time series database 230. As discussed, the time series database 230 can represent a location where raw network data can be stored and available to the central network entity message broker 210 for analysis. The data stored in each time series database 230 can include data generated by various network entities 120 within the network 100 and aggregated by a specific message broker 220 associated with the specific time series database. The content of the time series database 230 can be queried by the central network entity message broker 210, and the content of the time series database 230 can be uploaded to the central data repository or data lake according to the following schedule: a schedule that allows each network entity 120 hosting a time series database 230 to upload raw data to the central data repository without losing data stored in the time series database 230 (e.g., due to overwriting old data records within the time series database 230).

[0043] Figure 3 An example central analysis engine 112 is shown according to one embodiment, which can discover the network topology of the network 100, generate a distributed data management hierarchy based on the discovered network 100, and deploy data services to network entities 120 within the network 100 based on the generated distributed data management hierarchy. As shown, the central analysis engine 112 includes a processing resource 300, a memory 310, and a storage device 320 connected via a bus 330.

[0044] The memory 310 generally includes a network topology discovery service 312, a service deployer 314, and a top-level message broker 316. The network topology discovery service 312 is generally configured to discover network entities (e.g., routers, switches, access points, etc.) in the network 100 and endpoint devices connected to the network 100. Based on the discovered network topology, the network topology discovery service 312 can generate a distributed data management hierarchy that identifies data aggregation points within the network 100 and available resources at each network entity 120 in the network. As discussed above, information about available resources at the network entities 120 can be used to determine which services can be deployed to the network entities 120 within the network 100, thereby deploying computationally simple services to network entities 120 with limited processing power or limited excess computing resources and deploying computationally expensive services to network entities 120 with greater processing power or more excess computing resources. In some embodiments, information regarding available resources at a network entity 120 in the network 100 may also include information regarding whether specialized hardware (e.g., a graphics processing unit, a tensor processing unit, a field programmable gate array, etc.) is present at the network entity 120 that can be used for highly complex operations (e.g., training a machine learning model to identify anomalous and non-anomalous activity within the network 100).

[0045] The service deployer 314 generally deploys and configures data services at various network entities 120 within the network 100 using a distributed data management hierarchy. Network entities 120 identified as data aggregation points within the network 100 may be configured by the service deployer 314 to host data aggregation services and data storage services in which raw data from one or more other network entities and / or endpoint devices is stored. Other network entities 120 (e.g., network entities identified in the distributed data management hierarchy as network entities with greater processing power or excess computing resources) may be configured by the service deployer 314 to host services that perform more computationally expensive tasks such as data normalization, data deduplication, real-time data analysis, etc. In some embodiments, the service deployer 314 may also deploy data ingestion and normalization rules to the network entities 120 in the network 100 to identify data that each network entity 120 hosting a service 122 is to report to other network entities 120 and / or the central network entity 110. Data ingestion and normalization rules can also identify schedules that can offload raw data from local time series databases to a central data store or data lake.

[0046] In some embodiments, the service deployer 314 may additionally deploy a top-level message broker 316 to the central analytics engine 112. The top-level message broker 316 may be configured to aggregate data from various services 122 of the network entities 120 deployed to the network 100 and analyze the aggregated data to manage the network 100. When the top-level message broker 316 identifies anomalies in the data reported by the deployed services 122, the top-level message broker 316 may request the raw data from the appropriate services 122 for further detailed analysis.

[0047] The storage device 320 generally includes a central data repository 322 and a global data graph 324. The central data repository 322 generally provides a persistent data store where raw data reported by the network entities 120 can be stored for future analysis. The central data repository 322 can be periodically updated with newly captured raw data according to an upload schedule determined for each network entity 120, which is based on the following items: expected resource utilization for data upload operations, the amount of data that can be stored by each network entity 120, the peak resource utilization time at each network entity 120, etc. The global data graph 324 generally represents a fused data graph generated for each network entity 120, which identifies the data flows and locations where raw data for any given network operation can be stored. When the top-level message agent 316 receives summary data from the network entities 120 and identifies anomalies in the network (e.g., abnormal traffic, performance degradation, etc.), the top-level message agent 316 can use the global data graph to identify the location where the raw data associated with the received summary data is located and query the raw data from the identified location.

[0048] Figure 4 An example network entity 120 is shown on which data services can be deployed in a distributed data management hierarchy according to one embodiment. As shown, the network entity 120 includes processing resources 400, memory 410, and storage 420 connected via a bus 430.

[0049] The memory 410 generally includes a data flow normalization service 412 and a data uploader 414. The data flow normalization service 412 generally represents services and data processing rules deployed to the network entity 120 for processing data generated within the network 100 and providing information to the central network entity 110 for further analysis. The operations performed by any given data flow normalization service 412 may vary based on the available computing resources at the network entity. As discussed, a data flow normalization service 412 deployed on a network entity 120 with greater computing resources may perform more computationally expensive operations, such as real-time data processing, data deduplication, and other operations for reducing noise in data collected within the network 100. At the same time, a data flow normalization service 412 deployed on a network entity 120 with less computing resources may perform less computationally expensive operations, such as aggregating data from multiple network entities 120 into a single data set that can be provided to other network entities 120 for analysis.

[0050] The data uploader 414 typically uploads the captured raw data from the distributed time-series data store 422 according to a schedule determined based on resources available at the network entity 120. In general, the data uploader 414 can upload the captured raw data to the central data store or data lake in a manner that allows the network entity 120 to continuously record data related to the network 100 while avoiding performance degradation at the network entity 120. For example, the data uploader 414 can be configured to upload data during off-peak hours when the network entity 120 is serving relatively few devices. In another example, when the network entity 120 may not have sufficient storage capacity to store the raw data before the off-peak hours, the data uploader 414 can be configured to upload the data using a shorter period after the specified activity has terminated, etc.

[0051] Storage 420 generally includes a distributed time series data store 422 and a local data graph 424. Distributed time series data store 422 generally represents a data repository, such as a database, log file, flat file storage, or other area where data can be stored, where information related to operations performed within network 100 is temporarily stored until such data is uploaded to a central data repository or data lake by data uploader 414. Distributed time series data store 422 can be accessed by central network entity 110 and can provide requested data to central network entity 110 upon request.

[0052] The local data graph 424 generally represents a data structure that identifies data aggregated at the network entity 120, locations where such data may be stored, and network entities that trace such data. When the network entity 120 is configured to perform the service 412 as part of a distributed data management hierarchy, the local data graph 424 may be generated to identify to the central network entity 120 the data aggregated at or processed by the network entity 120. The local data graph 424 may be provided to the central network entity 110 to be fused with other local data graphs, such that the fused data graph provides a complete identification of the data captured and aggregated in the network 100, the locations where the data is captured and aggregated, etc.

[0053] Figure 5 It shows that according to an embodiment, a central network entity (e.g., Figure 1 1 and 10 ) to deploy a scalable hierarchical data automation service in a network. As shown, operations 500 may be entered at block 510, where the central network entity discovers a network topology of a centrally managed network. The network topology generally identifies network entities in the network and connections between network entities in the centrally managed network.

[0054] At block 520, the central network entity generates a data management hierarchy for the centrally managed network based on the network topology of the centrally managed network. The data management hierarchy generally defines data sources and data aggregation points in the centrally managed network. A data source may be defined as a network entity 120 that can generate and potentially store information related to operations within the network 100. A data aggregation point may represent a location within the network 100 where data from multiple data sources can be combined and in some cases analyzed, wherein the resulting analysis results are provided to the central network entity for further analysis. In some embodiments, a data management hierarchy may be generated based on the computing resources available at each network entity 120 in the network 100. For example, based on identifying a network entity as a network entity with limited computing resources or limited available computing resources, the data management hierarchy may identify the network entity as a location where data can be aggregated and the data can be handed over to other network entities for analysis. Similarly, based on identifying a network entity as a network entity with greater computing resources, the data management hierarchy may identify the network entity as a location where more computationally expensive data processing operations can be performed.

[0055] At block 530, based on the generated data management hierarchy, the central network entity deploys data services for ingesting and normalizing data to network entities in the centrally managed network. In some embodiments, deploying data services to network entities may include configuring various data ingestion and processing rules for each network entity on which the service is deployed. These data ingestion and processing rules may indicate, for example, which data will be logged or retained for further analysis, how the data will be deduplicated (e.g., which duplicate data can be retained and which duplicate data can be discarded), the type of data to be reported to the central network entity by the services deployed on the network entity 120, etc.

[0056] At block 540, the central network entity processes the data in the centrally managed network through the deployed data services. In some embodiments, the central network entity can act as a top-level data broker where data from various network entities is aggregated and analyzed. Based on the analysis, the central network entity can identify potential problems within the network 100 and request further information from one or more network entities to analyze these potential problems, identify the state of the network when the problem occurs, and take action to correct any problems in the network identified from the data stored within the network.

[0057] Figure 6 Example operations are shown that may be performed by a central network entity to configure services that are deployed to network entities when deploying a scalable hierarchical data automation service in a network according to an embodiment. As shown, operations 600 may be entered at block 610, where the central network entity identifies data services to be deployed to network entities in a centrally managed network. The data services to be deployed may be identified based on a data management hierarchy generated from a topology of the centrally managed network. For example, as discussed above, the data services to be deployed to a given network entity may be identified based on information in the data management hierarchy that identifies the network entity as a location where data from one or more other network entities may be aggregated and / or processed.

[0058] At block 620, the central network entity generates a local data graph for the network entity. The local data graph may identify data aggregated at the network entity and data generated by the network entity for aggregation by other network entities. In some embodiments, the local data graph may identify the source of the data aggregated at the network entity and the location where the data may be stored for future analysis.

[0059] At block 630, for data to be reported by the network entity to the central network entity, the central network entity determines data processing rules to be applied at the network entity to generate the data to be reported. The rules may identify, for example, the type of data to be calculated and reported by the network entity, the period for reporting generated data, etc. In some embodiments, the rules may also identify, for example, data upload and retention policies for raw data used by the network entity to generate data reported by the central network entity, as well as other rules that may be appropriate.

[0060] At block 640, the central network entity activates the data service. When activating the data service, the central network entity may activate data aggregation and generation services and provide data to other network entities according to the local data graph and the determined data processing rules.

[0061] In the above, reference is made to the embodiments presented in the present disclosure. However, the scope of the present disclosure is not limited to the specifically described embodiments. On the contrary, any combination of the described features and elements, whether or not related to different embodiments, is conceivable to implement and practice the intended embodiments. In addition, although the embodiments disclosed herein can achieve advantages over other possible solutions or prior art, whether or not a particular advantage is achieved by a given embodiment, the scope of the present disclosure is not limited. Therefore, the foregoing aspects, features, embodiments and advantages are merely illustrative and are not considered to be elements or limitations of the appended claims unless explicitly stated in (one or more) claims.

[0062] As mentioned above, including Figure 3 and Figure 4 , may include various computing components to perform the methods described herein. For example, buses 350 and 450 represent one or more of a variety of types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or a local bus using any of a variety of bus architectures. In some examples, such architectures may include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0063] In addition, central network entity 110 and network entity 120 typically include various computer system readable media. Such media can be any available media that can be accessed by central network entity 110 and / or network entity 120, and it includes volatile and non-volatile media, removable and non-removable media.

[0064] Figure 3 The memory 310 and Figure 4The memory 410 shown in the figure may include a computer system readable medium in the form of a volatile memory, such as a random access memory (RAM) and / or a cache memory. The central network entity 110 and the network entity 120 may also include other removable / non-removable volatile / non-volatile computer system storage media. In some examples, a storage system for reading from and writing to a non-removable non-volatile magnetic medium (not shown and generally referred to as a "hard drive") may be provided. Although not shown, a disk drive for reading from and writing to a removable non-volatile disk (e.g., a "floppy disk") and a disk drive for reading from or writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical media) may be provided. In this case, each may be connected to the bus 350 or the bus 450 via one or more data medium interfaces.

[0065] As depicted and described above, Figure 3 The memory 310 and Figure 4 The memory 410 shown in may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of an embodiment of the present invention. The central network entity 110 and the network entity 120 may also include other removable / non-removable volatile / non-volatile computer system storage media. In some examples, a storage system may be included as part of the memory 310 and the memory 410 and may generally provide non-volatile memory for networked computing devices, and may include one or more different storage elements, such as flash memory, hard disk drives, solid-state drives, optical storage devices, and / or magnetic storage devices.

[0066] In summary, techniques for deploying data services in a centrally managed network in a scalable hierarchical manner are described. Example methods generally include generating a topology description of a centrally managed network, the topology description identifying network entities in the centrally managed network and connections between network entities in the network. A data management hierarchy for the centrally managed network may be generated based on the topology description of the centrally managed network, and the data management hierarchy may identify network entities at which data services may be deployed in the centrally managed network. Data services and data rules may be deployed to the identified network entities based on the data management hierarchy, and data may be processed in the centrally managed network through the deployed data services.

[0067] In the present disclosure, various embodiments are referred to. However, the scope of the present disclosure is not limited to the specifically described embodiments. On the contrary, any combination of the described features and elements, whether or not related to different embodiments, is intended to be used to implement and practice the intended embodiments. In addition, when the elements of the embodiments are described in the form of "at least one of A and B", it should be understood that the embodiments including element A exclusively, element B exclusively, and element A and element B are considered to be included respectively. In addition, although some embodiments disclosed herein can achieve advantages that are superior to other possible solutions or superior to the prior art, whether or not a specific advantage is achieved by a given embodiment, the scope of the present disclosure is not limited. Therefore, the aspects, features, embodiments, and advantages disclosed herein are only illustrative and are not considered to be elements or limitations of the attached claims, unless explicitly stated in (one or more) claims. Similarly, reference to "the present invention" should not be interpreted as a generalization of any inventive subject matter disclosed herein, and should not be considered to be elements or limitations of the attached claims, unless explicitly stated in (one or more) claims.

[0068] As will be appreciated by those skilled in the art, the embodiments disclosed herein may be implemented as systems, methods, or computer program products. Therefore, the embodiments may take the form of complete hardware embodiments, complete software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects, which may generally be collectively referred to herein as "circuits," "modules," or "systems." In addition, the embodiments may take the form of computer program products contained in one or more computer-readable media, which contain computer-readable program code.

[0069] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0070] Computer program code for performing the operations of embodiments of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and the like, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0071] Various aspects of the present disclosure are described herein with reference to the flowchart and / or block diagram, device (system) and computer program product of the method of the embodiment proposed according to the present disclosure. It should be understood that each block of the flowchart and / or block diagram and the combination of the blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a method for implementing the function / behavior specified in (one or more) blocks of the flowchart and / or block diagram.

[0072] These computer program instructions may also be stored in a computer-readable medium, which may instruct a computer, other programmable data processing apparatus, or other device to operate in a specific manner so that the instructions stored in the computer-readable medium produce an article of manufacture including instructions for implementing the functions / behaviors specified in (one or more) blocks of the flowchart and / or block diagram.

[0073] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps executed on the computer, other programmable apparatus, or other device produces a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device provide a process for implementing the functions / actions specified in (one or more) blocks of the flowchart and / or block diagram.

[0074] The flow chart and block diagram in the figure show the architecture, function and operation of the possible implementation of the system, method and computer program product according to various embodiments. In this regard, each block in the flow chart or block diagram can represent a module, segment or part of code including one or more executable instructions for implementing the specified (one or more) logical functions. It should also be noted that in some alternative implementations, the functions marked in the block may not occur in the order marked in the figure. For example, depending on the functions involved, the two blocks shown in succession can actually be executed substantially at the same time, or sometimes these blocks can be executed in reverse order. It should also be noted that each block of the block diagram and / or flow chart and the combination of the blocks in the block diagram and / or flow chart can be implemented by a system based on special-purpose hardware that performs a specified function or action, or by a combination of special-purpose hardware and computer instructions.

[0075] In view of the above description, the scope of the present disclosure is determined by the following claims.

Claims

1. A method for deploying data services in a centrally managed network, comprising: generating a topology description of the centrally managed network, the topology description identifying network entities in the centrally managed network and connections between the network entities in the centrally managed network; generating a data management hierarchy for the centrally managed network based on the topology description of the centrally managed network, wherein the data management hierarchy identifies one or more of the network entities at which data services can be deployed in the centrally managed network; Deploying data services and data rules to the identified one or more network entities based on the data management hierarchy includes: generating, for each identified network entity, a local data graph describing data aggregated at the network entity, data generated by the network entity for aggregation by other network entities in the centrally managed network, and location information associated with a location at which the data aggregated at the network entity is stored; and The data in the centrally managed network is processed through the deployed data services.

2. The method according to claim 1, wherein: The data management hierarchy includes a hierarchy of computing resources available at each of the network entities in the centrally managed network to which data services can be deployed, and wherein deploying data services to the identified network entities includes deploying computationally inexpensive services to one or more of the network entities having limited computing resources and deploying computationally expensive services to network entities having less limited computing resources.

3. The method according to claim 1 or 2, wherein: The data management hierarchy identifies network entities in the centrally managed network to which data services can be deployed based on processing load patterns at the identified one or more network entities.

4. The method according to claim 1 or 2, wherein: At least one of the deployed data services includes a data normalization service configured to aggregate data from a plurality of network entities in the centrally managed network and remove duplicate data from the aggregated data.

5. The method according to claim 1 or 2, wherein: At least one of the deployed data services includes a data analysis service executed on a first network entity among the network entities, the data analysis service being configured to generate summary data based on the aggregated data set and provide the generated summary data to a central network entity, and wherein the aggregated data set is stored in a time series database located at the network entity.

6. The method according to claim 1 or 2, further comprising: monitoring resource availability changes of the network entities in the centrally managed network; as well as Data services are reallocated among the network entities in the centrally managed network based on the monitored changes in resource availability.

7. The method according to claim 1 or 2, further comprising: A global data graph is generated based on an aggregation of the local data graphs generated for each identified network entity.

8. The method according to claim 7, wherein: Processing data in the central management network includes: identifying, based on the data reported to the central network entity, one or more data sets to be retrieved from a time series database at one or more network entities deployed in the centrally managed network; and Based on identifying, in the global data graph, one or more network entities storing the one or more data sets, the one or more data sets are retrieved.

9. The method according to claim 1 or 2, wherein: The data rules include rules for identifying a schedule according to which raw data will be uploaded from multiple network entities deployed with a time series database service, and the schedule is based on one or more of the following items: one or more peak resource utilizations at the multiple network entities and an amount of data that can be stored at each of the multiple network entities.

10. The method according to claim 1 or 2, wherein: The centrally managed network includes a set of switches in a distributed network switch stack; One switch in the group of switches is designated as the primary switch; as well as Deploying the data service and the data rules to the identified network entity includes distributing the database service among a plurality of switches in the set of switches other than the designated primary switch.

11. A system for network communication, comprising: processor; as well as A memory having instructions stored thereon, wherein when the instructions are executed on the processor, operations for deploying data services in a centrally managed network are performed, the operations comprising: generating a topology description of the centrally managed network, the topology description identifying network entities in the centrally managed network and connections between the network entities in the centrally managed network; generating a data management hierarchy for the centrally managed network based on the topology description of the centrally managed network, wherein the data management hierarchy identifies one or more of the network entities at which data services can be deployed in the centrally managed network; Deploying data services and data rules to the identified one or more network entities based on the data management hierarchy includes: generating, for each identified network entity, a local data graph describing data aggregated at the network entity, data generated by the network entity for aggregation by other network entities in the centrally managed network, and location information associated with a location at which the data aggregated at the network entity is stored; and The data in the centrally managed network is processed through the deployed data services.

12. The system according to claim 11, wherein: The data management hierarchy includes a hierarchy of computing resources available at each of the network entities in the centrally managed network to which data services can be deployed, and wherein deploying data services to the identified network entities includes deploying computationally inexpensive services to one or more of the network entities having limited computing resources and deploying computationally expensive services to network entities having less limited computing resources.

13. The system according to claim 11 or 12, wherein: The data management hierarchy identifies network entities in the centrally managed network to which data services can be deployed based on processing load patterns at the identified one or more network entities.

14. The system according to claim 11 or 12, wherein: The operations also include: monitoring resource availability changes of the network entities in the centrally managed network; and Data services are reallocated among the network entities in the centrally managed network based on the monitored changes in resource availability.

15. The system according to claim 11 or 12, wherein: The operations also include: A global data graph is generated based on an aggregation of the local data graphs generated for each identified network entity.

16. The system of claim 15, wherein: Processing data in the central management network includes: identifying, based on the data reported to the central network entity, one or more data sets to be retrieved from a time series database at one or more network entities deployed in the centrally managed network; and Based on identifying, in the global data graph, one or more network entities storing the one or more data sets, the one or more data sets are retrieved.

17. The system according to claim 11 or 12, wherein: The data rules include rules for identifying a schedule according to which raw data will be uploaded from multiple network entities deployed with a time series database service, and the schedule is based on one or more of the following items: one or more peak resource utilizations at the multiple network entities and an amount of data that can be stored at each of the multiple network entities.

18. A computer-readable medium having instructions stored thereon, the instructions, when executed by a processor, performing operations for deploying data services in a centrally managed network, the operations comprising: generating a topology description of the centrally managed network, the topology description identifying network entities in the centrally managed network and connections between the network entities in the centrally managed network; generating a data management hierarchy for the centrally managed network based on the topology description of the centrally managed network, wherein the data management hierarchy identifies one or more of the network entities at which data services can be deployed in the centrally managed network; Deploying data services and data rules to the identified one or more network entities based on the data management hierarchy includes: generating, for each identified network entity, a local data graph describing data aggregated at the network entity, data generated by the network entity for aggregation by other network entities in the centrally managed network, and location information associated with a location at which the data aggregated at the network entity is stored; and The data in the centrally managed network is processed through the deployed data services.

19. An apparatus for deploying data services in a centrally managed network, comprising: means for generating a topology description of the centrally managed network, the topology description identifying network entities in the centrally managed network and connections between the network entities in the centrally managed network; means for generating a data management hierarchy for the centrally managed network based on the topology description of the centrally managed network, wherein the data management hierarchy identifies one or more of the network entities at which data services can be deployed in the centrally managed network; Device for deploying data services and data rules to one or more identified network entities based on the data management hierarchy, comprising: means for generating, for each identified network entity, a local data map describing data aggregated at the network entity, data generated by the network entity for aggregation by other network entities in the centrally managed network, and location information associated with a location at which the data aggregated at the network entity is stored; and Device for processing data in the centrally managed network through the deployed data service.

20. The apparatus of claim 19, further comprising means for implementing the method of any one of claims 2 to 10.

21. A computer program product or a computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 10.

Images