Patent ID: 11894996
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 27:
28. One or more non-transitory computer-readable media having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:
receive, at a collector, network flow data via an attached communications network;
evaluate the network flow data to derive a directed control flow graph corresponding to a distributed application, the control flow graph including a plurality of nodes and a plurality of edges between various nodes, wherein:
the nodes of the graph correspond to network-addressable application components connected to the communications network, each application component sending and receiving network traffic including one or more packets at a network interface;
one or more of the application components includes a workload creating and/or processing a data stream as part of the distributed application; and
edges between the nodes of the graph correspond to data streams between source nodes and destination nodes;

annotate one or more flows associated with one or more nodes and/or edges in the control flow graph with one or more tags, the tags relating to a functioning of the distributed application;
identify a pattern of normal behavior of the distributed application;
evaluate newly received network flow data using the pattern;
identify a change in conditions, the change in conditions including at least one of network traffic that varies from the normal behavior expected by the pattern and a change in the control flow graph; and
respond to the change in conditions.