Network Service Dependency Discovery via Packet Activity Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting problems in computer systems and networks are inefficient, often requiring substantial infrastructure and may fail to detect intermittent errors or attribute issues correctly, leading to delays and increased expenses.
Innovation Solution
An activity model is generated by monitoring packet channels, using probability distribution functions to determine correlations between input and output channels, allowing for the identification of related channels and the detection of potential issues without extensive probing or centralized data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If repeated probing of services is used to detect problems, then service availability can be determined, but detection delay increases and intermittent errors may be missed
Solution Approach 1:
The system performs preliminary actions by continuously monitoring packet traffic patterns and building activity models in advance, rather than waiting for periodic probes. This allows the system to detect service failures immediately when they occur, eliminating the detection delay inherent in periodic probing approaches while maintaining reliable service availability determination.
Solution Approach 2:
The patent introduces packet traffic analysis as an intermediary mechanism between service operations and failure detection. By analyzing the patterns of packets sent and received by services, the system can infer service health status continuously without needing to interrupt service operation with periodic probes, thus eliminating detection delay while maintaining reliable detection.
2Loss of information
If centralized alarm data processing is implemented, then alarm aggregation is achieved, but infrastructure complexity increases and detailed cause analysis becomes difficult
Solution Approach 1:
The system enables self-service by allowing each host to independently analyze its own packet traffic and generate activity models locally. This distributed approach eliminates the need for centralized alarm aggregation infrastructure, reducing system complexity while maintaining comprehensive monitoring capabilities. Each host serves itself by autonomously detecting and analyzing its service dependencies and failures.
Solution Approach 2:
The patent segments the monitoring system into independent host-level analysis units, each capable of autonomous packet traffic analysis and activity model generation. This segmentation eliminates the need for centralized data collection and processing infrastructure, reducing overall system complexity while maintaining comprehensive alarm aggregation capabilities through distributed analysis.
3Ease of operation
If conventional error detection methods are used, then initial error attribution is simplified, but incorrect error attribution occurs and expenses increase
Solution Approach 1:
The system changes the parameters used for error attribution from simple service-level observations to detailed packet traffic pattern analysis. By examining the temporal and statistical characteristics of packet flows between services, the system can accurately trace errors to their root causes, improving attribution accuracy while maintaining ease of operation through automated analysis.
Solution Approach 2:
The patent implements feedback mechanisms where activity models continuously compare expected versus actual packet traffic patterns. When deviations are detected, the system uses this feedback to accurately attribute errors to specific services or dependencies, improving attribution accuracy while maintaining operational simplicity through automated causal analysis.
Data Source
AI summary
An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing channels for packets for a predetermined window of time. To generate an activity model, an input and an output channel are selected. A probability distribution function describing the observed waiting time between packet arrivals on the selected input channel and the selected output channel is generated by mining the data collected during the selected window of time. A probability distribution function describing the observed waiting time between a randomly chosen instant and receiving a packet on the selected input channel is also generated. The distance between the two generated probability distribution functions is computed. If the computed distance is greater than a predefined confidence level, then the two selected channels are deemed to be related. Otherwise, the selected channels are deemed to be unrelated. The activity model is further generated by comparing each input and output channel pair entering or leaving a particular computer.