Network Service Dependency Inference Using Flow and Topology Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network service dependency detection tools fail to utilize all available data and often miss interactions between more than two services, leading to 'blind spots' and inaccurate dependency inference, especially in passive detection methods.
Innovation Solution
A system that uses flow data and network topology to detect network services, infer dependencies, and mitigate blind spots by analyzing dependency structures, pruning known dependencies, and continuously detecting new dependencies, while also detecting network attacks and deviations from normal operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If passive dependency inference tools are used, then implementation simplicity is improved, but measurement precision deteriorates due to blind spots in traffic observation
Solution Approach 1:
The patent combines multiple data sources (flow data, header data, and switching topology) that were previously used separately into a unified dependency inference system. This integration allows the system to cross-validate observations and fill blind spots by correlating traffic patterns with actual network topology, thereby improving measurement precision while maintaining passive operation
Solution Approach 2:
The patent introduces switching topology as an intermediary data source that mediates between observed traffic and inferred dependencies. By using topology information as a reference framework, the system can validate whether observed traffic patterns correspond to actual network paths, reducing false positives and improving detection accuracy without requiring active probing
2Device complexity
If traditional dependency detection tools are used, then device complexity is reduced, but loss of information increases due to inability to capture multi-service interactions
Solution Approach 1:
The patent implements a nested analysis structure where flow data provides the outer layer of observation, header data provides the middle layer of service identification, and switching topology provides the inner layer of path validation. This nested approach allows the system to capture multi-service interactions by correlating patterns across all three data layers, preserving information that would be lost in traditional two-service analysis
Solution Approach 2:
The patent adds the topology dimension to the traditional flow-based analysis. By incorporating spatial network structure information as an additional dimension, the system can distinguish between direct service interactions and indirect traffic flows, preventing false dependency inferences while capturing complex multi-service patterns that occur across different network paths
3Measurement precision
If flow data and topology analysis are combined, then measurement precision is improved, but device complexity increases due to multiple data processing requirements
Solution Approach 1:
The patent performs preliminary processing of switching topology data to create a reference framework of expected traffic patterns and valid service paths before analyzing flow data. By pre-computing topology-based constraints and valid interaction patterns, the system reduces the computational complexity of real-time dependency inference, as the multi-service correlation analysis can leverage this pre-established framework rather than computing from scratch
Solution Approach 2:
The system uses the observed flow data itself to validate against the topology framework, creating a self- verifying analysis process. The correlation between observed traffic patterns and topology-constrained expected patterns automatically validates dependency inferences, reducing the need for external verification mechanisms and simplifying the overall processing architecture while maintaining high precision
Data Source
AI summary
Described is system for inferring networks service dependencies. The system detects a set of network services from a set of network data. The system additionally detects a set of network service profiles in the set of network data. A network switching topology of the network is then determined. Finally, network service dependencies are inferred by analyzing a dependency structure of the network using at least one of the set of network services, the set of network service profiles, and the network topology.