CT-NOR Probabilistic Model for Network Dependency Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management and troubleshooting in enterprise networks face challenges due to complex, undocumented dependencies between hosts, protocols, and network services, leading to inefficient troubleshooting and security vulnerabilities.
Innovation Solution
A probabilistic model, specifically the Continuous Time Noisy Or (CT-NOR) model, is used to determine dependencies between network channels and services by analyzing the timing characteristics of packets, incorporating prior knowledge and statistical techniques to establish causal relationships and detect abnormalities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated discovery tools are deployed to map network dependencies, then troubleshooting efficiency improves, but system complexity and false positives increase
Solution Approach 1:
The patent introduces probabilistic models as intermediaries between raw network traffic data and dependency conclusions. These models act as mediators that process complex packet timing information and transform it into probabilistic dependency relationships, reducing the complexity burden on the automated discovery system while maintaining high troubleshooting efficiency
Solution Approach 2:
The patent transforms the problem from deterministic dependency detection to probabilistic parameter estimation. By changing the approach from binary (dependency exists/does not exist) to continuous probability values, the system can handle complexity more effectively and provide nuanced dependency strength measurements that reduce false positives
2Measurement precision
If probabilistic models are used to characterize dependencies, then measurement precision improves, but computational requirements and model complexity increase
Solution Approach 1:
The patent segments the complex probabilistic modeling task into distinct components: packet timing extraction, inter-arrival time calculation, probabilistic model selection, and parameter estimation. This segmentation allows each component to be optimized independently, improving measurement precision while managing overall model complexity through modular processing
Solution Approach 2:
The patent applies partial action by focusing probabilistic modeling only on critical packet flows and time windows rather than analyzing all network traffic continuously. This selective approach maintains high measurement precision for important dependencies while reducing computational burden and model complexity for less critical traffic
3Reliability
If continuous monitoring of packet timing is implemented, then anomaly detection capability improves, but data processing load and false alarms increase
Solution Approach 1:
The patent extracts only the essential timing characteristics (inter-arrival times, packet intervals) from continuous network traffic monitoring, discarding redundant packet payload and header information. This extraction approach maintains high anomaly detection capability by focusing on timing patterns while significantly reducing data processing load
Solution Approach 2:
The patent applies partial monitoring by continuously tracking timing characteristics only for packets involved in identified dependency relationships, rather than monitoring all network traffic. This selective continuous monitoring maintains high reliability for known dependencies while reducing overall data processing load and minimizing false alarms from unrelated traffic
Data Source
AI summary
Dependencies between different channels or different services in a client or server may be determined from the observation of the times of the incoming and outgoing of the packets constituting those channels or services. A probabilistic model may be used to formally characterize these dependencies. The probabilistic model may be used to list the dependencies between input packets and output packets of various channels or services, and may be used to establish the expected strength of the causal relationship between the different events surrounding those channels or services. Parameters of the probabilistic model may be either based on prior knowledge, or may be fit using statistical techniques based on observations about the times of the events of interest. Expected times of occurrence between events may be observed, and dependencies may be determined in accordance with the probabilistic model.