SYSTEMS AND METHODS FOR TEMPORAL CONTEXT MONITORING AND ENFORCEMENT FOR TELECOMMUNICATIONS NETWORKS

Methods and systems for temporal context monitoring and enforcement for telecommunications networks are disclosed. A first and a second set of metrics associated with a network are collected. The first set of metrics are associated with a first time and indicate a first state of the network. The second set of metrics are associated with a second time and indicate a second state of the network. An indication of an anomaly on the network is determined responsive to comparing the second set of metrics with the first set of metrics. A network policy is applied to revert the network from the second state to the first state.

BACKGROUND

Digital services can be provided by servers to client devices via a telecommunications network (also referred to herein as a “network”). For example, servers can provide access to web sites, applications, content, or other digital services. A monitoring system may monitor the network for adverse conditions (e.g., anomalies). The anomalies in the network may be indicative of one or more potentially disruptive events, such as distributed-denial-of-service (DDOS) attacks, route hijacking, service delivery element misconfiguration, unintentional network traffic excursions, or network infrastructure element failures, among others.

DETAILED DESCRIPTION

A network monitoring system may detect anomalies, determine a type of anomaly, generate a countermeasure specific to the type of anomaly, and apply the countermeasure to a network experiencing the anomaly. For example, the network monitoring system may detect an anomaly on a network (e.g., a telecommunications network). The anomaly may be associated with a disruptive event. For example, the anomaly may be caused by the disruptive event occurring on the network. The disruptive event may be of a type of event (e.g., a type of network attack, a DDOS attack, route hijacking, service delivery element misconfiguration, an unintentional network traffic excursion, or a network infrastructure element failure). The network monitoring system may determine the type of the disruptive event and/or the anomaly based on situationally specific circumstances (e.g., specifics of unwanted and/or harmful network traffic, perceived traffic source behaviors, a severity and/or scope of network fluctuations, etc.). Responsive to determining the type, the network monitoring system may generate one or more rules (e.g., a countermeasure) specific to the type of event and/or anomaly. The network monitoring system may then apply the rules to the network to potentially stop or limit the anomaly. While this method can generally be a rapid process, a faster process (e.g., instantaneous) that can return the network to a previous known-good state can be advantageous. For example, returning the network to the good state can achieve partial service recovery and forestall disruption from subsequent anomalies and network traffic excursions, among other negative events, with decreased latency (e.g., instantaneously).

A computer implementing the systems and methods described herein may return the network to a previous known-good state. For example, the computer may operate to collect sets of metrics associated with respective periods of time (e.g., one set per period of time) for determining states of operation of a network. The computer may operate to store the sets of metrics, the respective periods of time, and the states associated with each set of metrics. The computer may operate to detect an indication of an anomaly on the network (e.g., an anomaly caused by a potential attack). To do so, the computer may compare a first set of metrics indicating a first state (e.g., a good or normal state) with a second set of metrics (e.g., a current set of metrics, a set of metrics associated with a most recent period of time). The computer may generate (e.g., evaluate, calculate, determine) one or more network policies to revert the network from the second state (e.g., a state of undesirable network conditions, an anomalous state, a bad state, a current temporal state) to the first state (e.g., irrespective of a type of the anomaly, information regarding the causes of the anomaly, sources, affected services/applications/servers/content/infrastructure, etc.).

To detect the indication of the anomaly, the computer may compare a current set of metrics with a previous set of metrics. For example, the computer may store multiple sets of metrics (e.g., network attributes) over a period of time (e.g., snapshots of network conditions at specific times) as part of a continuous multidimensional analysis of the network. The computer may capture (e.g., collect, gather, obtain, receive, record) the sets of metrics periodically, aperiodically, at discrete intervals, or responsive to an event, among other times. The computer may store the sets of metrics in memory, in a cloud, in a database, or another storage system. The computer may determine a state of operation associated with each set of metrics and store an indication of the state with the respective set of metrics. For example, the computer may determine the state of operation based on comparing a current set of metrics to a previously stored set of metrics with a known state of operation. The previous set of metrics may be a most recently stored set of metrics, a set of metrics associated with a confidence score of the state of operation, or another set of metrics. The known state of operation may be a normal state of operation (e.g., a state of operation determined to not include anomalies, a state of operation including desirable network traffic and/or network conditions). The computer may compare the current state to the known state (e.g., compare the current set of metrics to the previous set of metrics, discern contemporaneous changes in various network attributes). Responsive to determining differences between the two, the computer may determine whether the current state is an anomalous state.

To generate the network policies, the computer may employ (e.g., use, utilize) one or more techniques. For example, the computer may use a network access control technique, a quality-of-service (QOS) technique, routing tables updates, intelligent DDOS mitigation systems (IDMSes), application/service/content entitlement techniques, or domain name system (DNS) record updates, among other techniques. The computer may use the techniques automatically in response to detecting an anomaly (e.g., regardless of a type of the anomaly). The computer may restore (e.g., revert, mimic) the network to a previous state of the network by using the techniques to enforce (e.g., limit, apply rules) conformance of the network (e.g., traffic on the network) to the previous state (e.g., within allowable parameters derived from attribute values recorded with the previous state).

The techniques described herein may result in various improvements in maintaining network stability. For example, adopting the temporal context monitoring and enforcement process described herein for telecommunications networks may allow for reduced latency for anomaly responses, increased adaptability to different types of anomalies (e.g., any type of anomaly, situationally-independent responses), restoration of network stability and functionality, improved reliability for anomaly responses, increased time for determining the type of anomaly and type specific anomaly responses (e.g., after reverting back to a known state, analyzing the anomalous state and generating type specific responses to be applied at a later time), reduced risk of overblocking (e.g., blocking desirable/good/legitimate network traffic) among other advantages.

FIG.1illustrates an example system100for temporal context monitoring and enforcement for telecommunications networks, in some embodiments. The system100may provide improved network anomaly response and monitoring of a network using temporal context monitoring and enforcement. In brief overview, the system100can include, access, or otherwise interface with one or more of client devices106a-n(hereinafter client device106or client devices106), service providers108a-n(hereinafter service provider108or service providers108), and data processing system110. The service providers108can each include a set of one or more servers502, depicted inFIG.5A, or a data center508, also depicted in5A. The data processing system110can collect data from the network105and store sets of metrics regarding communication sessions between the client devices106and the service providers108at different periods of time. The data processing system110can determine an indication of an anomaly on the network105based on a comparison between two or more sets of metrics associated with different periods of time. The data processing system110can apply a network policy to revert the network105from a second state (e.g., an anomalous state) to a first state (e.g., a state of normal operations before the anomaly).

The client devices106, the service providers108, and/or the data processing system110can include or execute on one or more processors or computing devices (e.g., the computing device503depicted inFIG.5C) and/or communicate via the network105. The network105may be a telecommunications network and can include computer networks such as the Internet, local, wide, metro, or other area networks, intranets, satellite networks, and other communication networks such as voice or data mobile telephone networks. The network105can be used to access information resources such as web pages, web sites, domain names, or uniform resource locators that can be presented, output, rendered, or displayed on at least one computing device (e.g., client device106), such as a laptop, desktop, tablet, personal digital assistant, smart phone, portable computers, or speaker. For example, via the network105, the client devices106can stream videos in video sessions provided by service providers108or otherwise communicate with the servers of the service providers108for data. In some embodiments, network105may be or include a self-organizing network that implements a machine learning model to automatically adjust connections and configurations of network elements of network105to optimize network connections (e.g., minimize latency, reduce dropped calls, increase data rate, increase quality of service, etc.).

Each of the client devices106, the service providers108, and/or the data processing system110can include or utilize at least one processing unit or other logic device such as programmable logic array engine, or module configured to communicate with one another or other resources or databases. The components of the client devices106, the service providers108, and/or the data processing system110can be separate components or a single component. System100and its components can include hardware elements, such as one or more processors, logic devices, or circuits.

Still referring toFIG.1, and in further detail, system100can include the service providers108. The service providers108may each be or include servers or computers configured to transmit or provide services across network105to client devices106. The service providers108may transmit or provide such services upon receiving requests for the services from any of the client devices106. The term “service” as used herein includes the supplying or providing of information over a network, and is also referred to as a communications network service. Examples of services include 5G broadband services, any voice, data or video service provided over a network, smart-grid network, digital telephone service, cellular service, Internet protocol television (IPTV), etc.

Client devices106can include or execute applications to receive data from the service providers108. For example, a client device106may execute a video application upon receiving a user input selection that causes the client device106to open the video application on the display. Responsive to executing the video application, a service provider108associated with the video application may stream a requested video to the client device106in a communication session. In another example, a client device106may execute a video game application. Responsive to executing the video game application, a service provider108associated with the video game application may provide data for the video game application to the client device106. The client devices106may establish communication sessions with the service providers108for any type of application or for any type of call.

A client device106can be located or deployed at any geographic location in the network environment depicted inFIG.1. A client device106can be deployed, for example, at a geographic location where a typical user using the client device106would seek to connect to a network (e.g., access a browser or another application that requires communication across a network). For example, a user can use a client device106to access the Internet at home, as a passenger in a car, while riding a bus, in the park, at work, while eating at a restaurant, or in any other environment. The client device106can be deployed at a separate site, such as an availability zone managed by a public cloud provider (e.g., a cloud510depicted inFIG.5B). If the client device106is deployed in a cloud510, the client device106can include or be referred to as a virtual client device or virtual machine. In the event the client device106is deployed in a cloud510, the packets exchanged between the client device106and the service providers108can still be retrieved by the data processing system110from the network105. In some cases, the client devices106and/or the data processing system110can be deployed in the cloud510on the same computing host in an infrastructure516(described below with respect toFIG.5B).

As service providers108provide or transmit data in communication sessions to client devices106, the data processing system110may intercept or otherwise monitor the control plane signaling data (e.g., control plane signaling data packets) of the communication sessions. The data processing system110may include one or more processors that are connected to a network equipment manufacturer (NEM) trace port of network105.

Data processing system110may comprise one or more processors that are configured to collect (e.g., obtain, receive) control plane signaling data and determine sets of metrics from the collected control plane signaling data. The data processing system110may comprise a network interface116, a processor118, and/or memory120. The data processing system110may communicate with any of the client devices106and/or the service providers108via the network interface116. The processor118may be or include an ASIC, one or more FPGAs, a DSP, circuits containing one or more processing components, circuitry for supporting a microprocessor, a group of processing components, or other suitable electronic processing components. In some embodiments, the processor118may execute computer code or modules (e.g., executable code, object code, source code, script code, machine code, computer-readable instructions, etc.) stored in the memory120to facilitate the operations described herein. The memory120may be any volatile or non-volatile computer-readable storage medium capable of storing data or computer code.

Memory120may include a data collector122, a metric database124, an anomaly detector126, a network policy manager128, and an exporter130, in some embodiments. In brief overview, the components122-130may collect sets of metrics associated with the network105at different periods of time and store the sets of metrics (e.g., maintain and update a table of metrics). The sets of metrics may be associated with different states of operation of the network105(e.g., a normal state of operation, a good state of operation, an anomalous state of operation). The components122-130may detect (e.g., determine, generate, calculate) an indication of an anomaly on the network105based on a comparison of a second set of metrics with a first set of metrics that indicate a first state of operation (e.g., normal or good). The components122-130may generate (e.g., calculate, determine) a network policy (e.g., network restrictions, network traffic rules) to revert the network105from the second state (e.g., potentially anomalous state) to the first state by applying the network policy on the network105.

The data collector122may comprise programmable instructions that, upon execution, cause the processor118to obtain or collect data (e.g., control plane signaling data packets) from the network105. In some cases, the collected data may be associated with various metrics. For example, the data may be associated with communications relationships, network traffic rates and composition, source counts and distribution, queries/see, packet sizes, and routing table entries, among other observable and quantifiable network attributes. The metrics may include packet level metrics (e.g., classless inter-domain routing (CIDR), autonomous system number (ASN), Geographical information, time-to-live (TTL), packet sizes in and out), application metrics (e.g., various DNS, hypertext transfer protocol (HTTP), and session initiation protocol (SIP) fields and values), traffic metrics (e.g., network traffic analysis, client traffic analysis), and service responses (e.g., network metrics, application response times), among other metrics associated with the network105.

In some examples, the data collector122may collect the data continuously. For example, the data collector122may collect the data at discrete time intervals, periodically, aperiodically, or in response to an event (e.g., a trigger). The data collector122may generate a set of metrics based on the collected data being collected at a time interval (e.g., during a time period). The data collector122may generate a respective set of metrics for each time data is collected. The data collector122may store (e.g., record) the sets of metrics in the metric database124.

The metric database124may be a database (e.g., relational, non-relational, object oriented) that stores the sets of metrics and associated time period data, among other potential data. In some cases, the data collector122may store such data from multiple communication sessions between different nodes with identifiers to distinguish between the communication sessions. In some examples, the data collector122may store the data in memory instead of the metric database124. The data collector122, the processor118, and/or another component of the memory120may retrieve data from the metric database124to analyze the network105, determine indications of an anomaly, and generate network policies, among other uses.

The anomaly detector126may comprise programmable instructions that, upon execution, cause the processor118to detect anomalies that occur at the network105. In some cases, the anomaly detector126may analyze a set of metrics to determine whether the set of metrics is associated with an anomalous state of the network105. To do so, the anomaly detector126may compare the set of metrics to another set of metrics, aggregate (e.g., average) values of multiple sets of metrics, or predefined values associated with the set of metrics. The anomaly detector126may determine a difference between the set of metrics and the other set of metrics. In some cases, the difference satisfying a threshold may indicate a potential anomaly. In some cases, an operator may determine whether the difference indicates a potential anomaly. The anomaly detector126may detect the indication (e.g., detect the difference satisfies the threshold, receive input from the operator) and notify the network policy manager.

The network policy manager128may comprise programmable instructions that, upon execution, cause the processor118to generate (e.g., calculate, determine) one or more network policies for the network105. For example, the network policy manager128may generate multiple network policies, each with an associated estimate of impact (e.g., how the policy may impact the network, potential risk of overblocking, etc.). The network policy manager128or the operator may select a policy from the multiple policies to apply to the network based on the estimates of impact (e.g., choose the policy with the least impact). In some cases, the network policy manager128may generate a single network policy to revert a current state of the network105to a previous (known) state of the network105. In some examples, the network policy manager128may use a network access control technique, a QOS technique, routing table updates, IDMSes, application/service/content entitlement techniques, or domain name system (DNS) record updates, among other techniques to generate the network policies. The network policy manager128may generate the policies regardless of the type of anomaly detected.

The network policy manager128may comprise programmable instructions that, upon execution, cause the processor118to apply (e.g., implement, update) the generated (selected) policy to the network105. For example, the network policy manager128may apply one or more rules associated with the generated policy. The rules may restrict (e.g., limit, ban, reject) types of network traffic or other network attributes to match the previous state (e.g., a good state) of the network105, as described herein with reference toFIG.3, as an example. By matching the current state of the network105to a known state of the network105, the network policy manager128can revert the state of the network105to a previous state without the indication of an anomaly. The network policy manager128(or the operator) may then analyze the indication of anomaly and determine next steps (e.g., to prevent the indication, to stop the anomaly, to generate situationally specific policies to block an attack associated with the anomaly, etc.).

The exporter130may comprise executable instructions that, upon execution by the processor118, may export the generated network policies, indications of the anomaly, indications of the sets of metrics, predictions for a type of the anomaly, or any combination thereof (e.g., generated data), to the data processing system110, the service providers108, or another computing device. For example, the exporter134may create an exportable file (e.g., a file with a format such as BIL, GRD/TAB, PNG, ASKII, KMZ, etc.) from the generated data and transmit the exportable file to the computing device for display. The exporter130may transmit the exportable file to the computing device responsive to a request from the computing device. In some embodiments, the exporter130may generate and/or export exportable files to the computing device at set intervals to provide the computing device with real-time updates of the performance of communication sessions between nodes. In some cases, the exporter134may export the generated data by streaming the generated data or sending the generated data via a log output, among other various forms of transferring data.

FIG.2is an illustration of a flow diagram of a process200for temporal context monitoring and enforcement for telecommunications networks, in accordance with an implementation. The process200can be performed by a data processing system (a client device, the data processing system110, shown and described with reference toFIG.1, a server system, etc.). The process200may include more or fewer operations and the operations may be performed in any order. Performance of the process200may enable the data processing system to collect sets of metrics associated with different time intervals of a network. The sets of metrics may indicate multiple types of states of the network. Based on a comparison between multiple sets of metrics, the process200may enable the data processing system to generate one or more network policies and apply the network policy to the network. By applying the network policy to the network, the data processing system can revert a state of the network to a previous state of the network.

At operation202, the data processing system collects a first set of metrics associated with a network at a first time. The data processing system may collect the first set of metrics at the first time (e.g., a time period, a time interval) based on a periodic interval, an aperiodic interval, or other trigger. The first set of metrics may indicate a first state of the network. For example, the first set of metrics may indicate a state of normal or good operation of the network. The first set of metrics may indicate desirable network traffic and network performance are being maintained (e.g., conducted). The first set of metrics may include one or more packet level metrics, one or more application metrics, one or more traffic metrics, or one or more service response metrics. In some cases, the data processing system may collect the first set of metrics by collecting, over a period of time, multiple sets of metrics indicating the first state and determining the first set of metrics based on a combination of each set of metrics of the multiple sets. At operation204, the data processing system stores (e.g., record) the first set of metrics, the first state, the first time, or indications thereof, among other data.

At operation206, the data processing system collects a second set of metrics associated with the network at a second time. The second set of metrics may indicate a second state of the network. The second state may be a state of anomaly. The data processing system may collect the second set of metrics similarly to the first set of metrics, but at a time (the second time) after the first time, and store the second set of metrics similarly to the first set of metrics. In some cases, the second set of metrics may at least comprise one or more packet level metrics, one or more application metrics, one or more traffic metrics, or one or more service response metrics. At operation208, the data processing system determines whether the second set of metrics indicate an anomalous state. The data processing system may determine an indication of an anomaly (e.g., potentially caused by an attack) on the network based on a comparison of the second set of metrics with the first set of metrics. To do so, the data processing system may determine a difference between the second set of metrics and the first set of metrics. If the difference satisfies a threshold (e.g., are outside of normal operations), the data processing system may determine the second set of metrics indicate the second state of the network and determine the indication of the anomaly and continue to operation210, otherwise the data processing system may return to operation202. In some cases, the data processing system may compare the second set of metrics with an aggregate value of the first set of metrics and other previous sets of metrics indicating the first state.

At operation210, the data processing system applies a network policy to revert the network from the second state to the first state in response to determining the indication of the anomaly. To do so, the data processing system may generate a set of network rules associated with limiting network traffic on the network. In some cases, the set of network rules may be associated with multiple network policies. The data processing system may select a subset of the set of network rules based on associated estimates of impact on the network if the respective rule were to be applied. For example, the data processing system may select a network rule of the set to be a part of the network policy based on a lowest estimate of impact value among similar network rules of the set. In some cases, applying the network policy includes selecting at least one of the first set of metrics to implement on the network. For example, the data processing system may select a first metric of the first set of metrics. The data processing system may generate one or more network rules to revert an associated metric of the second set of metrics to the first metric (e.g., the data processing system may restrict a source of network traffic to only be from sources of the first state).

In some implementations, the data processing system may monitor the network in response to applying the network policy. For example, the data processing system may monitor an effect of the network policy on the network (e.g., on metrics or attributes of the network). Based on the monitoring, the data processing system may take action (e.g., perform an action of a set of actions). For example, the action taken may include adjusting the network policy to increase a limitation of network traffic on the network or to reduce a limitation of network traffic on the network responsive to determining an impact of the network policy on the network (e.g., if the network policy is overblocking a percentage of desirable network traffic the data processing system may reduce the limitation). The action taken may include determining a type of anomaly associated with the anomaly, applying a second network policy based on the type of anomaly, and removing the network policy responsive to applying the second network policy. For example, by applying the network policy, the data processing system may increase an amount of time available to determine the type of the anomaly based on situationally specific circumstances and generate the second network policy, in which the situationally specific circumstances are addressed. The second network policy may be a type specific policy specialized in addressing the determined type of anomaly (e.g., more accurate network rules to specifically target the type of anomaly occurring). The data processing system may continue to monitor the network and determine that the anomaly has ended. The data processing system may remove (e.g., end, revert, change) the network policy, the second network policy, or both, based on the determination.

FIG.3is a table300providing an example for temporal context monitoring and enforcement for telecommunications networks, in accordance with an implementation. The table300includes a first column302, a second column304, a third column306, a fourth column308, a first row310, a second row312, and a third row314. The first column302includes time data, the second column304includes first one or more metrics (e.g., network metrics, network attributes), the third column306includes second one or more metrics (e.g., response times), the fourth column308includes an indication of a type of state (e.g., a state of the network), the first row310may be associated with a first set of metrics collected at a first time, T1, the second row312may be associated with a second set of metrics collected at a second time, T2, and the third row314may be associated with a third set of metrics collected at a third time, T3. The table300may include more or fewer columns or rows, where each column or row may indicate a different type of data than illustrated (e.g., theFIG.3is for illustrative purposes of one example and many other examples are possible and contemplated).

In some cases, a network monitoring system (e.g., the data processing system110) may collect network data. The network monitoring system may store the collected data in a database (e.g., the metric database124). The network monitoring system may collect the data at different times. For example, at T1, the network monitoring system may collect various metrics. The metrics may include client population per country, continent, sector, area, etc.; network traffic per traffic type; response times per type; and other metrics. In an example ofFIG.3, the row310can include both USA and Europe client populations of p1 (e.g., 90%) and p2 (e.g., 10%), respectively; both user datagram protocol (UDP)53and transmission control protocol (TCP)443at n1 (e.g., 10%) and n2 (e.g., 90%), respectively; and both DNS and Web response times of t1 (e.g., 0.1 seconds(s)) and t2 (e.g., 0.1 s), respectively. At T2, after T1, the row312can include both USA and Europe client populations of p3 (e.g., 85%) and p4 (e.g., 15%), respectively; both UDP53and TCP443at n3 (e.g., 11%) and n4 (e.g., 89%), respectively; and both DNS and Web response times of t3 (e.g., 0.15 s) and t4 (e.g., 0.1 s), respectively. The network monitoring system may determine that each of the row310and312indicate normal operations (e.g., none of the metrics are outside of or satisfy predefined thresholds, a comparison between row310and312is within expected/normal operation) and record an indication of the state of row310and row312as being normal. At T3, after T2, the row314can include USA, Europe, and China client populations of p5, p6, and p7 (e.g., 10%, 5%, and 85%), respectively; UDP53, TCP443, and UDP11211at n5, n6, and n7 (e.g., 1%, 19%, and 80%), respectively; and both DNS and Web response times of t5 and t6 (e.g., 1.5 s and 5.2 s), respectively. The network monitoring system may compare the response time metrics to the previous response time metrics of rows310and312(e.g., known good response times) and determine that the difference between the row314response times and the previous row response times satisfies a threshold. Responsive to the determination, the network monitoring system may determine an indication of anomaly. The network monitoring system may record the state of row314as indicating an anomaly.

In some cases, the network monitoring system may revert the state of the network to a previous state. For example, based on determining the state of anomaly, the network monitoring system may generate one or more network policies to enable the network to return to previous conditions associated with normal operation (e.g., reverting to most recent metrics showing normal network conditions). Referring to the example ofFIG.3, the network monitoring system may generate rules to lock down the network environment. The rules may only allow clients from the USA and Europe regions to connect and only allow UDP53and TCP443traffic on the network. The network monitoring system may automatically apply the rules (the network policy) to block the unwanted traffic and revert back to the state found at row312(when only USA and Europe clients were active and only UDP53and TCP443traffic were active). Thus, traffic from Chinese clients, including the UDP11211traffic, will be blocked, most likely allowing for the resumption of acceptable response levels.

In some cases, the network monitoring system may classify the anomaly. For example, the anomaly may be a network attack. The network monitoring system may determine the type of attack and generate specific rules to stop this type of attack. For example, the network monitoring system may implement a type of GEO filter to block Chinese clients or a network access list which blocks (or rate limits) UDP11211network traffic. The network monitoring system may apply the GEO filter and/or the network access list and remove the network policy (e.g., a rapid response network policy, a temporal context monitoring and enforcement network policy).

In some cases, more or fewer metrics may be tracked (e.g., collected, received, and/or obtained). By collecting more metrics, the network monitoring system may generate more precise and strict network policies that reduce a risk of overblocking and of attack traffic bypassing the network polices. For example, if an attacker notices that using the UDP11211attack from China is no longer successful, the attacker may activate a botnet in Europe to send attack traffic to TCP port443. However, by collecting the TCP443metric, the network monitoring system can implement a rate limiting network rule for clients of network traffic based on previously seen values (e.g., metrics associated with rows312and310, limiting Europe to 15%). If the attacker activates a USA based botnet to send attack traffic on TCP port443, by tracking network traffic per USA based client, the network monitoring system can implement a rule to disallow new USA clients to exceed previously seen levels. In some cases, based on other parameters (e.g., computational power, resources, tolerance for strictness, etc.) the network monitoring system may select more of fewer metrics to track.

FIG.4is a flow diagram of a process400for temporal context monitoring and enforcement for telecommunications networks, in accordance with an implementation. The process400can be performed by a data processing system (the data processing system110, shown and described with reference toFIG.1, a server system, etc.). The process400may include more or fewer operations and the operations may be performed in any order.

At operation402, the data processing system gathers a set of metrics and service levels (e.g., values indicating amount of network service provided). For example, the data processing system can gather sets of metrics periodically, aperiodically, or in response to an event. The data processing system may store the set of metrics and the service levels. In some cases, the types of metrics and service levels the data processing system gathers may be adjustable. For example, the data processing system may automatically select which metrics and levels to gather. An operator of the data processing system may adjust the types of metrics and levels to gather. In some cases, the data processing system may gather the metrics and service levels via a network probe, via direct access to the network, or via the service providers.

At operation404, the data processing system checks if service levels are within normal bounds. For example, the data processing system can compare the collected service levels with previous service levels. If the difference between the collected service levels and the previous service levels satisfies a threshold (e.g., the normal bounds), then the data processing system may determine the service levels exceed the normal bounds, indicating a potential anomaly (e.g., current response times are well above previous response times).

At operation406, the data processing system checks for a potential DDOS attack. For example, the data processing system can use a rapid attack analysis. The data processing system may check traffic volume levels or check for attack patterns (e.g., known attack patterns) that relate to DDOS attacks. While the illustration ofFIG.4uses a DDOS attack as an example, it is understood that the disclosure can be for other types of attacks or abnormal network behavior.

At operation408, the data processing system looks up (e.g., retrieves, determines) the latest (e.g., most recent) set of metrics which are within acceptable service levels. For example, the data processing system may access a metrics database410(e.g., the metrics database124). The data processing system may determine a most recent (e.g., a time closest to a current time) set of metrics associated with a normal state of operation (e.g., row312). In some cases, the data processing system may perform an aggregation of a set of sets of metrics associated with the normal state (e.g., both rows310and312). By aggregating (e.g., averaging) the sets of metrics, the data processing system may level out (e.g., determine an average) time-specific metrics (e.g., to account for time dependent metrics that, while captured at one time, relate to different time zones for different regions).

At operation412, the data processing system constructs a network policy. The data processing system may use the metrics from operation408to construct the network policy. To do so, the data processing system may generate the network policy to allow network traffic that match the metrics (e.g., UDP53and TCP443) and restrict network traffic that does not match the metrics (e.g., UDP11211). In some cases, the data processing system may generate multiple network policies. The data processing system may generate a respective estimate of impact on the network if each network policy were to be applied. The data processing system may select a network policy based on the respective estimate of impact (e.g., least impact).

At operation414, the data processing system applies (e.g., deploys) the network policy of the operation412. For example, the data processing system may apply one or more rules to restrict network traffic on the network. At operation416, the data processing system monitors the network policy after application. For example, the data processing system may collect and analyze another set of metrics after implementing the network policy. The data processing system may determine whether the network policy satisfies one or more thresholds based on analyzing the other set of metrics. If the network policy restricts an amount of desirable network traffic that satisfies a first threshold (e.g., is too strict), the data processing system may adjust the network policy to be looser (e.g., less strict, allowing more types of network traffic). If the network policy allows an amount of undesirable network traffic that satisfies a second threshold (e.g., is too loose), the data processing system may adjust the policy to be stricter (e.g., restricting more types of network traffic). For example, if a new service was deployed without communicating the deployment to the data processing system, the data processing system may mistakenly restrict network traffic to the new service. Thus, adjusting the network policy may allow for unintended events to be corrected.

At operation418, the data processing system determines a type of anomaly. For example, after implementing the network policy, the data processing system may have time to determine a specific anomaly is occurring and generate an anomaly specific network policy. The data processing system may determine that the anomaly is of a first type. For example, the first type may be one of many types of anomalies that can indicate various attacks or undesirable network conditions. The data processing system may determine the anomaly to be of the first type based on one or more anomaly detecting techniques. The data processing system may build a second network policy (e.g., an attack policy) specific (e.g., situationally specific policy) to the first type of anomaly (e.g., attack). The data processing system may apply the second network policy to block the determined type of anomaly. At operation420, the data processing system monitors the network to determine if the anomaly persists. If the anomaly persists, the data processing system may adjust (e.g., build another) the second network policy. At operation422, the data processing system determines the anomaly to have stopped and may remove the network policy, the second network policy, or both. The data processing system continues back to operation402.

FIG.5Adepicts an example network environment that can be used in connection with the methods and systems described herein. In brief overview, the network environment500includes one or more client devices106(also generally referred to as clients, client node, client machines, client computers, client computing devices, endpoints, or endpoint nodes) in communication with one or more servers502(also generally referred to as servers, nodes, or remote machine) via one or more networks105. In some embodiments, a client106has the capacity to function as both a client node seeking access to resources provided by a server and as a server providing access to hosted resources for other client devices106.

AlthoughFIG.5Ashows a network105between the client devices106and the servers502, the client devices106and the servers502can be on the same network105. In embodiments, there are multiple networks105between the client devices106and the servers502. The network105can include multiple networks such as a private network and a public network. The network105can include multiple private networks.

The network105can be connected via wired or wireless links. Wired links can include Digital Subscriber Line (DSL), coaxial cable lines, or optical fiber lines. The wireless links can include BLUETOOTH, Wi-Fi, Worldwide Interoperability for Microwave Access (WiMAX), an infrared channel or satellite band. The wireless links can also include any cellular network standards used to communicate among mobile devices, including standards that qualify as 1G, 2G, 3G, 4G, 5G or other standards. The network standards can qualify as one or more generation of mobile telecommunication standards by fulfilling a specification or standards such as the specifications maintained by International Telecommunication Union. Examples of cellular network standards include AMPS, GSM, GPRS, UMTS, LTE, LTE Advanced, Mobile WiMAX, and WiMAX-Advanced. Cellular network standards can use various channel access methods e.g. FDMA, TDMA, CDMA, or SDMA. In some embodiments, different types of data can be transmitted via different links and standards. In other embodiments, the same types of data can be transmitted via different links and standards.

The network105can be any type and/or form of network. The geographical scope of the network105can vary widely and the network105can be a body area network (BAN), a personal area network (PAN), a local-area network (LAN), e.g. Intranet, a metropolitan area network (MAN), a wide area network (WAN), or the Internet. The topology of the network105can be of any form and can include, e.g., any of the following: point-to-point, bus, star, ring, mesh, or tree. The network105can be an overlay network which is virtual and sits on top of one or more layers of other networks105. The network105can be of any such network topology as known to those ordinarily skilled in the art capable of supporting the operations described herein. The network105can utilize different techniques and layers or stacks of protocols, including, e.g., the Ethernet protocol or the internet protocol suite (TCP/IP). The TCP/IP internet protocol suite can include application layer, transport layer, internet layer (including, e.g., IPv6), or the link layer. The network105can be a type of a broadcast network, a telecommunications network, a data communication network, or a computer network.

The network environment500can include multiple, logically grouped servers502. The logical group of servers can be referred to as a data center508(or server farm or machine farm). In embodiments, the servers502can be geographically dispersed. The data center508can be administered as a single entity or different entities. The data center508can include multiple data centers508that can be geographically dispersed. The servers502within each data center508can be homogeneous or heterogeneous (e.g., one or more of the servers502or machines502can operate according to one type of operating system platform (e.g., WINDOWS NT, manufactured by Microsoft Corp. of Redmond, Washington), while one or more of the other servers502can operate on according to another type of operating system platform (e.g., Unix, Linux, or macOS)). The servers502of each data center508do not need to be physically proximate to another server502in the same machine farm508. Thus, the group of servers502logically grouped as a data center508can be interconnected using a network. Management of the data center508can be de-centralized. For example, one or more servers502can comprise components, subsystems and modules to support one or more management services for the data center508.

Server502can be a file server, application server, web server, proxy server, appliance, network appliance, gateway, gateway server, virtualization server, deployment server, SSL VPN server, or firewall. In embodiments, the server502can be referred to as a remote machine or a node. Multiple nodes can be in the path between any two communicating servers.

FIG.5Billustrates an example computing environment. A computing environment501can provide client106with one or more resources provided by a network environment. The computing environment501(e.g., a cloud computing environment, an on premise computing environment, etc.) can include one or more client devices106, in communication with the cloud510over one or more networks105. Client devices106can include, e.g., thick clients, thin clients, and zero clients. A thick client can provide at least some functionality even when disconnected from the cloud510or servers502. A thin client or a zero client can depend on the connection to the cloud510or server502to provide functionality. A zero client can depend on the cloud510or other networks105or servers502to retrieve operating system data for the client device. The cloud510can include back end platforms, e.g., servers502, storage, server farms or data centers.

The cloud510can be public, private, or hybrid. Public clouds can include public servers502that are maintained by third parties to the client devices106or the owners of the clients. The servers502can be located off-site in remote geographical locations as disclosed above or otherwise. Public clouds can be connected to the servers502over a public network. Private clouds can include private servers502that are physically maintained by client devices106or owners of clients. Private clouds can be connected to the servers502over a private network105. Hybrid clouds508can include both the private and public networks105and servers502.

The cloud510can also include a cloud-based delivery, e.g. Software as a Service (Saas)512, Platform as a Service (PaaS)514, and the Infrastructure as a Service (IaaS)516. IaaS can refer to a user renting the use of infrastructure resources that are needed during a specified time period. IaaS providers can offer storage, networking, servers or virtualization resources from large pools, allowing the users to quickly scale up by accessing more resources as needed. PaaS providers can offer functionality provided by IaaS, including, e.g., storage, networking, servers or virtualization, as well as additional resources such as, e.g., the operating system, middleware, or runtime resources. SaaS providers can offer the resources that PaaS provides, including storage, networking, servers, virtualization, operating system, middleware, or runtime resources. In some embodiments, SaaS providers can offer additional resources including, e.g., data and application resources.

Client devices106can access IaaS resources, SaaS resources, or PaaS resources. In embodiments, access to IaaS, PaaS, or SaaS resources can be authenticated. For example, a server or authentication server can authenticate a user via security certificates, HTTPS, or API keys. API keys can include various encryption standards such as, e.g., Advanced Encryption Standard (AES). Data resources can be sent over Transport Layer Security (TLS) or Secure Sockets Layer (SSL).

The client106and server502can be deployed as and/or executed on any type and form of computing device, e.g., a computer, network device or appliance capable of communicating on any type and form of network and performing the operations described herein.

FIG.5Cdepicts block diagrams of a computing device503useful for practicing an embodiment of the client106or a server502. As shown inFIG.5C, each computing device503can include a central processing unit518, and a main memory unit520. As shown inFIG.5C, a computing device503can include one or more of a storage device536, an installation device532, a network interface534, an I/O controller522, a display device530, a keyboard524or a pointing device526, e.g. a mouse. The storage device536can include, without limitation, a program540, such as an operating system, software, or software associated with system100.

The central processing unit518is any logic circuitry that responds to and processes instructions fetched from the main memory unit520. The central processing unit518can be provided by a microprocessor unit, e.g.: those manufactured by Intel Corporation of Mountain View, California. The computing device503can be based on any of these processors, or any other processor capable of operating as described herein. The central processing unit518can utilize instruction level parallelism, thread level parallelism, different levels of cache, and multi-core processors. A multi-core processor can include two or more processing units on a single computing component.

Main memory unit520can include one or more memory chips capable of storing data and allowing any storage location to be directly accessed by the microprocessor518. Main memory unit520can be volatile and faster than storage536memory. Main memory units520can be Dynamic random access memory (DRAM) or any variants, including static random access memory (SRAM). The memory520or the storage536can be non-volatile; e.g., non-volatile read access memory (NVRAM). The memory520can be based on any type of memory chip, or any other available memory chips. In the example depicted inFIG.5C, the processor518can communicate with memory520via a system bus538.

I/O devices528can have both input and output capabilities, including, e.g., haptic feedback devices, touchscreen displays, or multi-touch displays. Touchscreen, multi-touch displays, touchpads, touch mice, or other touch sensing devices can use different technologies to sense touch, including, e.g., capacitive, surface capacitive, projected capacitive touch (PCT), in-cell capacitive, resistive, infrared, waveguide, dispersive signal touch (DST), in-cell optical, surface acoustic wave (SAW), bending wave touch (BWT), or force-based sensing technologies. Some multi-touch devices can allow two or more contact points with the surface, allowing advanced functionality including, e.g., pinch, spread, rotate, scroll, or other gestures. Some touchscreen devices, including, e.g., Microsoft PIXELSENSE or Multi-Touch Collaboration Wall, can have larger surfaces, such as on a table-top or on a wall, and can also interact with other electronic devices. Some I/O devices528, display devices530or group of devices can be augmented reality devices. The I/O devices can be controlled by an I/O controller522as shown inFIG.5C. The I/O controller522can control one or more I/O devices, such as, e.g., a keyboard524and a pointing device526, e.g., a mouse or optical pen. Furthermore, an I/O device can also provide storage and/or an installation device532for the computing device503. In embodiments, the computing device503can provide USB connections (not shown) to receive handheld USB storage devices. In embodiments, an I/O device528can be a bridge between the system bus538and an external communication bus, e.g. a USB bus, a SCSI bus, a FireWire bus, an Ethernet bus, a Gigabit Ethernet bus, a Fibre Channel bus, or a Thunderbolt bus.

In embodiments, display devices530can be connected to I/O controller522. Display devices can include, e.g., liquid crystal displays (LCD), electronic papers (e-ink) displays, flexile displays, light emitting diode displays (LED), or other types of displays. In some embodiments, display devices530or the corresponding I/O controllers522can be controlled through or have hardware support for OPENGL or DIRECTX API or other graphics libraries. Any of the I/O devices528and/or the I/O controller522can include any type and/or form of suitable hardware, software, or combination of hardware and software to support, enable or provide for the connection and use of one or more display devices530by the computing device503. For example, the computing device503can include any type and/or form of video adapter, video card, driver, and/or library to interface, communicate, connect or otherwise use the display devices530. In embodiments, a video adapter can include multiple connectors to interface to multiple display devices530.

The computing device503can include a storage device536(e.g., one or more hard disk drives or redundant arrays of independent disks) for storing an operating system or other related software, and for storing application software programs540such as any program related to the systems, methods, components, modules, elements, or functions depicted inFIG.1, or2. Examples of storage device536include, e.g., hard disk drive (HDD); optical drive including CD drive, DVD drive, or BLU-RAY drive; solid-state drive (SSD); USB flash drive; or any other device suitable for storing data. Storage devices536can include multiple volatile and non-volatile memories, including, e.g., solid state hybrid drives that combine hard disks with solid state cache. Storage devices536can be non-volatile, mutable, or read-only. Storage devices536can be internal and connect to the computing device503via a bus538. Storage device536can be external and connect to the computing device503via an I/O device530that provides an external bus. Storage device536can connect to the computing device503via the network interface534over a network105. Some client devices106may not require a non-volatile storage device536and can be thin clients or zero client devices106. Some storage devices536can be used as an installation device532and can be suitable for installing software and programs.

The computing device503can include a network interface534to interface to the network105through a variety of connections including, but not limited to, standard telephone lines LAN or WAN links (e.g., 802.11, T1, T3, Gigabit Ethernet, Infiniband), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet-over-SONET, ADSL, VDSL, BPON, GPON, fiber optical including FiOS), wireless connections, or some combination of any or all of the above. Connections can be established using a variety of communication protocols (e.g., TCP/IP, Ethernet, ARCNET, SONET, SDH, Fiber Distributed Data Interface (FDDI), IEEE 802.11a/b/g/n/ac CDMA, GSM, WiMax and direct asynchronous connections). The computing device503can communicate with other computing devices503via any type and/or form of gateway or tunneling protocol e.g. Secure Socket Layer (SSL) or Transport Layer Security (TLS), QUIC protocol, or the Citrix Gateway Protocol manufactured by Citrix Systems, Inc. of Ft. Lauderdale, Florida. The network interface534can include a built-in network adapter, network interface card, PCMCIA network card, EXPRESSCARD network card, card bus network adapter, wireless network adapter, USB network adapter, modem or any other device suitable for interfacing the computing device503to any type of network capable of communication and performing the operations described herein.

A computing device503of the sort depicted inFIG.5Ccan operate under the control of an operating system, which controls scheduling of tasks and access to system resources. The computing device503can be running any operating system configured for any type of computing device, including, for example, a desktop operating system, a mobile device operating system, a tablet operating system, or a smartphone operating system.

The computing device503can be any workstation, telephone, desktop computer, laptop or notebook computer, netbook, ULTRABOOK, tablet, server, handheld computer, mobile telephone, smartphone or other portable telecommunications device, media playing device, a gaming system, mobile computing device, or any other type and/or form of computing, telecommunications or media device that is capable of communication. The computing device503has sufficient processor power and memory capacity to perform the operations described herein. In some embodiments, the computing device503can have different processors, operating systems, and input devices consistent with the device.

In embodiments, the status of one or more machines106,502in the network105can be monitored as part of network management. In embodiments, the status of a machine can include an identification of load information (e.g., the number of processes on the machine, CPU and memory utilization), of port information (e.g., the number of available communication ports and the port addresses), or of session status (e.g., the duration and type of processes, and whether a process is active or idle). In another of these embodiments, this information can be identified by a plurality of metrics, and the plurality of metrics can be applied at least in part towards decisions in load distribution, network traffic management, and network failure recovery as well as any aspects of operations of the present solution described herein.

The processes, systems and methods described herein can be implemented by the computing device503in response to the CPU518executing an arrangement of instructions contained in main memory520. Such instructions can be read into main memory520from another computer-readable medium, such as the storage device536. Execution of the arrangement of instructions contained in main memory520causes the computing device503to perform the illustrative processes described herein. One or more processors in a multi-processing arrangement may also be employed to execute the instructions contained in main memory520. Hard-wired circuitry can be used in place of or in combination with software instructions together with the systems and methods described herein. Systems and methods described herein are not limited to any specific combination of hardware circuitry and software.

At least one aspect of a technical improvement to existing techniques is directed to a method. The method may comprise collecting, by one or more processors, a first set of metrics associated with a network at a first time, the first set of metrics indicating a first state of the network; collecting, by the one or more processors, a second set of metrics associated with the network at a second time, the second set of metrics indicating a second state of the network; determining, by the one or more processors, an indication of an anomaly on the network based on a comparison of the second set of metrics with the first set of metrics; and applying, by the one or more processors, a network policy to revert the network from the second state to the first state in response to determining the indication of the anomaly.

At least one aspect of this technical solution is directed to a system. The system may comprise one or more memories having computer-readable instructions stored thereon. The one or more memories may be in communication with a one or more processors that execute the computer readable instructions to collect a first set of metrics associated with a network at a first time, the first set of metrics indicating a first state of the network; collect a second set of metrics associated with the network at a second time, the second set of metrics indicating a second state of the network; determine an indication of an anomaly on the network based on a comparison of the second set of metrics with the first set of metrics; and apply a network policy to revert the network from the second state to the first state in response to determining the indication of the anomaly.

At least one aspect of this technical solution is directed to a non-transitory computer-readable storage media comprising computer readable instructions stored thereon that, when executed by one or more processors, cause the one or more processors to collect a first set of metrics associated with a network at a first time, the first set of metrics indicating a first state of the network; collect a second set of metrics associated with the network at a second time, the second set of metrics indicating a second state of the network; determine an indication of an anomaly on the network based on a comparison of the second set of metrics with the first set of metrics; and apply a network policy to revert the network from the second state to the first state in response to determining the indication of the anomaly.

The foregoing detailed description includes illustrative examples of various aspects and implementations and provides an overview or framework for understanding the nature and character of the claimed aspects and implementations. The drawings provide illustration and a further understanding of the various aspects and implementations and are incorporated in and constitute a part of this specification.

The subject matter and the operations described in this specification can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. The subject matter described in this specification can be implemented as one or more computer programs, e.g., one or more circuits of computer program instructions, encoded on one or more computer storage media for execution by, or to control the operation of, data processing apparatuses. A computer storage medium can be, or be included in, a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. While a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, or be included in, one or more separate components or media (e.g., multiple CDs, disks, or other storage devices). The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

While operations are depicted in the drawings in a particular order, such operations are not required to be performed in the particular order shown or in sequential order, and all illustrated operations are not required to be performed. Actions described herein can be performed in a different order. The separation of various system components does not require separation in all implementations, and the described program components can be included in a single hardware or software product.

The phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. Any references to implementations or elements or acts of the systems and methods herein referred to in the singular may also embrace implementations including a plurality of these elements, and any references in plural to any implementation or element or act herein may also embrace implementations including only a single element. Any implementation disclosed herein may be combined with any other implementation or embodiment.

The foregoing implementations are illustrative rather than limiting of the described systems and methods. Scope of the systems and methods described herein is thus indicated by the appended claims, rather than the foregoing description, and changes that come within the meaning and range of equivalency of the claims are embraced therein.