Network Traffic Correlation Analysis for Application Health Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application management systems lack semantic understanding of network traffic data, leading to ineffective real-time monitoring of network application health, and often fail to identify the source or cause of unhealthy application states due to data-intensive monitoring techniques and loss of packet trace information.
Innovation Solution
A method for parsing and filtering network traffic data in real-time using a kernel space driver interface, which collects, extracts, and stores transaction data, generates events, and performs correlation analysis to identify causally related metrics, allowing for the generation of filtered and aggregated data to provide real-time health information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection (DPI) is performed to monitor network traffic, then application performance data can be collected, but the data collection becomes data-intensive and ineffective for real-time health information
Solution Approach 1:
The patent segments network traffic monitoring into two distinct components: (1) a data collection layer using kernel space drivers to capture raw network packets, and (2) a data processing layer that performs semantic analysis and correlation. This segmentation allows the system to collect comprehensive data without processing all data at full speed, thereby improving real-time performance while maintaining monitoring accuracy.
Solution Approach 2:
The patent extracts only the essential transaction data from network packets using protocol-specific parsers that identify and extract relevant fields (such as request/response pairs, transaction identifiers, and performance metrics). This extraction approach eliminates the need to process entire packet streams, reducing data intensity while preserving the ability to detect application health issues accurately.
2Measurement precision
If a large number of data streams are analyzed to determine application health, then comprehensive monitoring is achieved, but the system lacks semantic understanding and cannot identify the source or cause of problems
Solution Approach 1:
The patent introduces protocol-specific parsers as intermediary components between raw network packets and the analysis system. These parsers act as semantic mediators that understand application-layer protocols (HTTP, SQL, LDAP, etc.) and translate raw packet data into meaningful transaction events. This intermediary layer preserves packet trace information by structuring it in a semantically meaningful way, enabling the system to identify both the source and cause of application health issues.
Solution Approach 2:
The patent transforms network packet parameters into application-specific transaction parameters through protocol parsing. Instead of analyzing raw packet fields, the system converts them into semantic parameters such as transaction type, request/response status, and application-specific metrics. This parameter transformation enables semantic understanding while preserving the traceability of original packet data through structured event representation.
3Difficulty of detecting and measuring
If packet trace information is collected for analysis, then diagnostic capability is improved, but packet trace information may be lost in data-intensive processing
Solution Approach 1:
The patent performs preliminary action by capturing and structuring packet trace information at the point of network traffic flow using kernel space drivers. Transaction data is parsed and stored in structured events with preserved trace information before any data-intensive processing occurs. This preliminary structuring ensures that diagnostic information is captured and maintained in an organized format, preventing information loss during subsequent analysis stages.
Data Source
AI summary
Provided are methods and computer program products for monitoring the contents of network traffic in a network device and performing correlation analysis of collected performance metrics to help identify reasons for network performance issues. Methods for correlation analysis include selecting scope and network metric types to include in the correlation analysis to generate an educated candidate set for correlation analysis. The correlation analysis methods result in a hypothesis set that assist the operator in identifying transactions and infrastructure problems resulting in network performance degradation.