Patent ID: 11894996
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A network traffic monitoring system comprising:
a collector comprising one or more processors and a non-transitory computer-readable medium, an analytics module, a policy engine, and an alerting module, wherein the collector is communicably attached to a communications network and receives a stream of network flow data via the attached communications network;
wherein the analytics module evaluates the stream of network flow data to generate a directed control flow graph corresponding to components of a distributed application, the control flow graph including a plurality of nodes and a plurality of directed edges between various nodes;
wherein the nodes of the graph correspond to network-addressable application components connected to the communications network, each application component sending and receiving network traffic including one or more packets at a network interface local to the application component;
wherein one or more of the application components includes a workload creating and/or processing a data stream as part of the distributed application;
wherein the edges between the nodes of the graph correspond to data streams between source nodes and destination nodes;
wherein one or more flows associated with one or more nodes and/or edges in the control flow graph are annotated with one or more tags, the one or more tags relating to a functioning of the distributed application; and
wherein the analytics module further evaluates the stream of network flow data to identify patterns of normal behavior of the distributed application, uses the patterns to evaluate newly received information from the stream of network flow data, and upon identifying newly received information that varies from the patterns of normal behavior, responds via an alerting module.