System and method for management of cloud-based systems
System and method for reporting usage of a network infrastructure includes obtaining a map that includes at least one flow-mapping that correlates a flow feature with a service and that correlates a flow feature with an endpoint type, wherein the endpoint types include at least a subscriber type and a service type; at a first computer, receiving flow telemetry of a network infrastructure, the flow telemetry representing at least the destination and source attributes for network traffic in the flow telemetry; categorizing the flow telemetry into at least a subscriber flow category based on the source and destination endpoint types of the traffic; for subscriber flow telemetry of a subscriber, processing the subscriber flow telemetry into at least one flow feature; identifying at least one service to attribute to at least a portion of the subscriber flow telemetry, the service identified through the processed flow feature and a flow-mapping.
1. A method for reporting usage of a network infrastructure comprising:
performing by one or more computers:
obtaining a map of a plurality of flow-mappings that each correlates a flow feature with an endpoint type, wherein the endpoint type is a subscriber or a service;
receiving flow telemetry comprising a plurality of destination and source attributes for network traffic of the network infrastructure;
determining a first flow feature associated with a first portion of the flow telemetry based on the map; and
when a second flow feature cannot be determined for a second portion of the flow telemetry and the second portion of the flow telemetry is related to the first portion of the flow telemetry:
assigning the first flow feature as the second flow feature associated with the second portion of the flow telemetry.
2. The method of claim 1 , further comprising:
consolidating duplicate flow telemetry.
3. The method of claim 1 , further comprising:
determining, based on the map and the flow telemetry, an amount of traffic driven by a type of service through the network infrastructure.
4. The method of claim 1 , further comprising:
categorizing the flow telemetry into at least one subscriber flow telemetry, wherein the first portion of the flow telemetry comprises a first portion of a subscriber flow telemetry for a subscriber.
5. The method of claim 4 , wherein the map includes at least one flow-mapping that correlates a domain name to a service, and wherein categorizing the flow telemetry into at least one subscriber flow telemetry further comprises:
identifying domain name service (DNS) recursive responses sent to the subscriber, wherein a recursive response identifies a component address that corresponds to a domain name; and
identifying the first portion of the subscriber flow telemetry from the subscriber to the component address.
6. The method of claim 4 , further comprising:
identifying at least one service to attribute to the first portion of the subscriber flow telemetry.
7. The method of claim 6 , wherein identifying the at least one service further comprises:
identifying the at least one service for the first portion of the subscriber flow telemetry through a flow-mapping that correlates the first flow feature to the service.
8. The method of claim 4 , further comprising:
tracking combinations of component use as a flow feature.
9. The method of claim 8 , wherein tracking combinations of component use comprises:
tracking substantially simultaneous component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating at least two components of simultaneous usage to a service.
10. The method of claim 8 , wherein tracking combinations of component use comprises:
tracking a sequence of component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating a sequence of at least two components to a service.
11. The method of claim 8 , wherein tracking combinations of component use comprises:
tracking proportions of component usage by the subscriber, and wherein at least one service to be attributed to the first portion of the subscriber flow telemetry is identified through a flow-mapping correlating usage proportion ranges of at least two components to a service.
12. The method of claim 8 , wherein tracking combinations of component use comprises:
tracking a traffic profile of a component accessed by the subscriber, and
limiting possible identified services to services correlated with flow feature of the traffic profile.
13. The method of claim 1 , further comprising:
compiling data on services attributed to portions of the flow telemetry; and
rendering the data in a service analytics interface.
14. The method of claim 1 , wherein the flow feature in the map is one or more Internet Protocol (IP) addresses.
15. A system comprising:
one or more computers programmed to perform operations comprising:
obtaining a map of a plurality of flow-mappings that each correlates a flow feature with an endpoint type, wherein the endpoint type is a subscriber or a service;
receiving flow telemetry comprising a plurality of destination and source attributes for network traffic of the network infrastructure;
determining a first flow feature associated with a first portion of the flow telemetry based on the map; and
when a second flow feature cannot be determined for a second portion of the flow telemetry and the second portion of the flow telemetry is related to the first portion of the flow telemetry:
assigning the first flow feature as the second flow feature associated with the second portion of the flow telemetry.
16. The system of claim 15 , wherein the operations further comprise:
consolidating duplicate flow telemetry.
17. The system of claim 15 , wherein the operations further comprise:
determining, based on the map and the flow telemetry, an amount of traffic driven by a type of service through the network infrastructure.
18. The system of claim 15 , wherein the operations further comprise:
categorizing the flow telemetry into at least one subscriber flow telemetry, wherein the first portion of the flow telemetry comprises a first portion of the subscriber flow telemetry for a subscriber.
19. The system of claim 18 , wherein the map includes at least one flow-mapping that correlates a domain name to a service, and wherein categorizing the flow telemetry into at least one subscriber flow telemetry further comprises:
identifying domain name service (DNS) recursive responses sent to the subscriber, wherein a recursive response identifies a component address that corresponds to a domain name; and
identifying the first portion of the subscriber flow telemetry from the subscriber to the component address.
20. The system of claim 18 , wherein the operations further comprise:
identifying at least one service to attribute to the first portion of the subscriber flow telemetry.