Network Topology Mapping via Traffic Flow Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for mapping and monitoring network topology are inefficient and ineffective, particularly in complex networks, as they rely on software agents, ICMP trace routes, or port scanning, which can be hindered by firewalls, fail to detect duplicates, and do not account for service dependencies beyond client-server relationships.
Innovation Solution
A method involving monitoring traffic flows to identify requested services, determining the origin and destination of these flows, and using this information to map the topology by identifying upstream and downstream computers, which includes determining the role of each computer based on its traffic behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software agents are installed on each computer to map network topology, then mapping accuracy is improved, but device complexity and implementation difficulty increase
Solution Approach 1:
The patent extracts the topology mapping function from individual software agents on each computer and consolidates it into a centralized system. The centralized system collects traffic flow information from network monitors and performs topology discovery without requiring complex agents on every device, thereby reducing device complexity while maintaining mapping accuracy.
Solution Approach 2:
The patent introduces network traffic flow information as an intermediary to bridge the gap between simple network monitoring and comprehensive topology mapping. By analyzing traffic flow patterns (source, destination, protocol, ports) collected from network monitors, the system infers topology relationships without needing complex agents on each device.
2Ease of operation
If ICMP trace route is used to map network topology, then ease of operation is improved, but reliability deteriorates due to firewall blocking
Solution Approach 1:
The patent uses network traffic flow information as an intermediary that bypasses firewall restrictions. Instead of relying on ICMP echo requests that may be blocked, the system analyzes existing network traffic (HTTP, FTP, SMTP protocols) to infer topology relationships, thereby achieving reliable topology mapping without being hindered by firewalls.
Solution Approach 2:
The patent substitutes the mechanical ICMP trace route mechanism with a software-based traffic flow analysis approach. By parsing network packets and extracting flow information (source IP, destination IP, protocol, ports), the system replaces the traditional ICMP-based topological discovery with a more reliable software analysis method that works through firewalls.
3Measurement precision
If port scanning is used to discover network services, then measurement precision is improved, but object-generated harmful factors increase due to security risks
Solution Approach 1:
The patent converts the potentially harmful port scanning activity into a beneficial passive traffic flow analysis. Instead of actively scanning ports which triggers security alerts, the system analyzes existing network traffic to infer service information, thereby achieving service detection without generating security risks.
Solution Approach 2:
The patent introduces network traffic flow information as an intermediary that provides service detection capabilities without direct port scanning. By analyzing traffic patterns (source, destination, protocol, ports) from legitimate network operations, the system infers service information without generating the harmful effects of active scanning.
4Ease of operation
If traditional client-server relationship mapping is used, then ease of operation is improved, but measurement precision deteriorates due to inability to detect complex service dependencies
Solution Approach 1:
The patent makes the traffic flow analysis approach universal by using the same methodology to detect various types of service dependencies (client-server, server-server, peer-to-peer). The system analyzes traffic flow patterns to identify relationships between any pair of network elements, not just traditional client-server pairs, thereby achieving comprehensive service dependency detection.
Solution Approach 2:
The patent implements feedback by continuously monitoring network traffic flows and updating topology information based on observed traffic patterns. The system analyzes traffic between network elements to infer service relationships and dependency directions, providing accurate measurement of complex service dependencies through ongoing traffic analysis feedback.
Data Source
AI summary
A method of determining the topology of at least part of a network comprising the steps of: monitoring traffic to and/or from a plurality of computers in the network; storing information relating to the monitored traffic for each of the plurality of computers, the information including an identifier of a requested service; selecting a first computer of the plurality of computers; reading the stored information related to the first computer and identifying, using the stored identifier of the requested service, at least one traffic flow to or from the first computer that corresponds to the requested service; using the stored information to identify the destination or origin of the identified traffic flow for the first computer, which traffic flow information includes the identifier of the requested service; using the identified destination or origin to identify one or more computers that are immediately upstream or downstream of the first computer, and determining a topology based on the identified one or more upstream or downstream computers.