Methods, systems, and computer readable media for identifying relationships between network applications from monitored network traffic
A method for identifying dependencies between network applications includes determining, from the network traffic or the network traffic metadata, counts indicating numbers of times that applications residing on the web servers are contacted after the same and other applications residing on the web servers and computing, using the counts and for each of the applications, a contact probability. The method further includes computing, using the counts and for each of the applications, an observed probability indicating a likelihood that the application will be contacted after another of the applications, and computing, from the contact probabilities and the observed probabilities, application dependency scores for pairs of the applications. The method further includes using the application dependency scores to determine relationships between the applications in the pairs of applications.
1 . A method for identifying application dependencies from monitored network traffic, the method comprising:
receiving network traffic or network traffic metadata from communication sessions between web clients and web servers;
determining, from the network traffic or the network traffic metadata, counts indicating numbers of times that applications residing on the web servers are contacted after the same and other applications residing on the web servers;
computing, using the counts and for each of the applications, a contact probability;
computing, using the counts and for each of the applications, an observed probability indicating a likelihood that the application will be contacted after another of the applications;
computing, from the contact probabilities and the observed probabilities, application dependency scores for pairs of the applications, where the application dependency scores each indicate a likelihood that one application in a pair of applications is dependent on another application in the pair of applications; and
using the application dependency scores to determine relationships between the applications in the pairs of applications.
2 . The method of claim 1 wherein receiving network traffic or network traffic metadata includes receiving network traffic at an application dependency detector executing on a network packet broker.
3 . The method of claim 1 wherein receiving network traffic or network traffic metadata includes receiving the network traffic or network traffic metadata at an application dependency detector residing on a network tool.
4 . The method of claim 1 wherein computing the contact probabilities includes, for each of the applications, dividing a count of the number of times the application was contacted by a sum of counts that all of the applications were contacted.
5 . The method of claim 1 wherein computing the observed probabilities includes, for each of the applications, dividing a count of a number of times the application was contacted after a first application of the applications by a sum of counts of numbers of times that that the application was contacted after all of the applications.
6 . The method of claim 1 wherein computing the application dependency score includes computing a Bayes match percentage for each of the pairs of applications.
7 . The method of claim 1 wherein using the application dependency scores to determine relationships between the applications in the pairs of applications includes using the application dependency scores to determine that one of the applications in a pair is dependent on another of the applications in the pair.
8 . The method of claim 1 wherein using the application dependency scores to determine relationships between the applications in the pairs of applications includes using the application dependency scores to determine that one of the applications in a pair is not dependent on another of the applications in the pair.
9 . The method of claim 1 wherein using the application dependency scores to determine relationships between the applications in the pairs of applications includes using the application dependency scores to determine that one of the applications in a pair represents a content delivery network for another of the applications in the pair.
10 . The method of claim 1 wherein using the application dependency scores to determine relationships between the applications in the pairs of applications includes using the application dependency scores to determine that one of the applications in a pair represents a microservice for another of the applications in the pair.
11 . A system for identifying application dependencies from monitored network traffic, the system comprising:
a network packet broker or a network tool including at least one processor and a memory; and
an application dependency detector implemented by the at least one processor for receiving network traffic or network traffic metadata from communication sessions between web clients and web servers, determining, from the network traffic or the network traffic metadata, counts indicating numbers of times that applications residing on the web servers are contacted after the same and other applications residing on the web servers, computing, using the counts and for each of the applications, a contact probability, computing, using the counts and for each of the applications, an observed probability indicating a likelihood that the application will be contacted after another of the applications, computing, from the contact probabilities and the observed probabilities, application dependency scores for pairs of the applications, where the application dependency scores each indicate a likelihood that one application in a pair of applications is dependent on another application in the pair of applications, and using the application dependency scores to determine relationships between the applications in the pairs of applications.
12 . The system of claim 11 wherein the network packet broker or the network tool comprises a network packet broker.
13 . The system of claim 11 wherein the network packet broker or the network tool comprises a network tool.
14 . The system of claim 11 wherein the application dependency detector is configured to compute the contact probabilities by, for each of the applications, dividing a count of the number of times the application was contacted by a sum of counts that all of the applications were contacted.
15 . The system of claim 11 the application dependency detector is configured to compute the observed probabilities by, for each of the applications, dividing a count of a number of times the application was contacted after a first application of the applications by a sum of counts of numbers of times that that the application was contacted after all of the applications.
16 . The system of claim 11 wherein the application dependency detector is configured to compute the application dependency score by computing a Bayes match percentage for each of the pairs of applications.
17 . The system of claim 11 wherein the application dependency detector is configured to use the application dependency scores to determine relationships between the applications in the pairs of applications by using the application dependency scores to determine that one of the applications in a pair is dependent on another of the applications in the pair.
18 . The system of claim 11 wherein the application dependency detector is configured to use the application dependency scores to determine relationships between the applications in the pairs of applications by using the application dependency scores to determine that one of the applications in a pair is not dependent on another of the applications in the pair.
19 . The system of claim 11 wherein the application dependency detector is configured to use the application dependency scores to determine relationships between the applications in the pairs of applications by using the application dependency scores to determine that one of the applications in a pair represents a content delivery network or a microservice for another of the applications in the pair.
20 . A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
receiving network traffic or network traffic metadata from communication sessions between web clients and web servers;
determining, from the network traffic or the network traffic metadata, counts indicating numbers of times that applications residing on the web servers are contacted after the same and other applications residing on the web servers;
computing, using the counts and for each of the applications, a contact probability;
computing, using the counts and for each of the applications, an observed probability indicating a likelihood that the application will be contacted after another of the applications;
computing, from the contact probabilities and the observed probabilities, application dependency scores for pairs of the applications, where the application dependency scores each indicate a likelihood that one application in a pair of applications is dependent on another application in the pair of applications; and
using the application dependency scores to determine relationships between the applications in the pairs of applications.