Granted Patent B2

US 10,680,973 · App. 16/239,761 · Granted Jun 9, 2020

Abstract

Claims (48)

1. A method comprising:

collecting communication data travelling among a plurality of computing nodes in a networked environment;

using the communication data to create a plurality of connectivity records, wherein a connectivity record of the plurality of connectivity records comprises a communication between a source computing node and a destination computing node of the plurality of computing nodes;

associating the communication with an application context;

associating the communication with a protocol;

determining that the source computing node is configured to offer a computing service;

generating a modified connectivity record based at least partly on the connectivity record, wherein the modified connectivity record comprises data representing (1) the source computing node as an updated destination computing node of the communication and (2) the destination computing node as an updated source computing node of the communication;

processing the plurality of connectivity records to eliminate connectivity records that meet at least one criteria, wherein the plurality of connectivity records includes associated application contexts and protocols, wherein a first portion of the plurality of connectivity records comprises the eliminated connectivity records, and wherein a second portion of the plurality of connectivity records comprises the remainder of the connectivity records; and

building a graph using the second portion of the plurality of connectivity records.

2. The method of claim 1 , wherein using the communication data to create the plurality of connectivity records comprises creating the connectivity record using communication data representing at least one of: a socket-level communication, an active TCP communication, a port on which a computer is listening, IP communication information, configuration information, error log information, or detected behavior information.

3. The method of claim 1 , further comprising:

determining a location associated with the communication represented by the connectivity record based at least partly on a subnet associated with the communication represented by the connectivity record; and

tagging the connectivity record with data representing at least one of the subnet or the location.

4. The method of claim 1 , further comprising:

determining that an address associated with the communication represented by the connectivity record is associated with a plurality of subnets; and

tagging the connectivity record with data representing a subnet of the plurality of subnets having a fewest number of addresses.

5. The method of claim 1 , further comprising generating service table data representing computing nodes offering computing services, wherein determining that the source computing node is configured to offer the computing service is based at least partly on the service table data.

6. The method of claim 1 , further comprising determining that a first computing node of the plurality of computing nodes is offering a computing service based at least partly on the first computing node holding a socket in a listening state.

7. The method of claim 6 , further comprising generating a service table record indicating the first computing node is offering the service, wherein the service table record comprises data representing a port number and a time interval that the first computing node is holding the socket in the listening state.

8. The method of claim 1 , further comprising:

determining a quantity of times that a first computing node of the plurality of computing nodes communicates via a particular port; and

determining, based on the quantity satisfying a criterion, that the first computing node is offering a computing service.

9. The method of claim 1 , further comprising identifying an application based at least partly on a depth-first traversal of the graph, wherein the application is identified based at least partly on a subgraph representing a plurality of associated connectivity records.

10. The method of claim 1 , further comprising identifying an application based at least partly on a breath-first traversal of the graph, wherein the application is identified based at least partly on a subgraph representing a plurality of associated connectivity records.

11. A system comprising:

computer-readable memory storing computer-executable instructions; and

one or more processors in communication with the computer-readable memory and configured by the computer-executable instructions to at least:

collect communication data travelling among a plurality of computing nodes in a networked environment;

create a plurality of connectivity records using the communication data, wherein a connectivity record of the plurality of connectivity records comprises a communication between a source computing node and a destination computing node of the plurality of computing nodes;

determine that the source computing node is configured to offer a computing service;

generate a modified connectivity record based at least partly on the connectivity record, wherein the modified connectivity record comprises data representing (1) the source computing node as an updated destination computing node of the communication and (2) the destination computing node as an updated source computing node of the communication;

process the plurality of connectivity records to eliminate connectivity records that meet at least one criteria, wherein a first portion of the plurality of connectivity records comprises eliminated connectivity records, and wherein a second portion of the plurality of connectivity records comprises a remainder of the connectivity records; and

build a graph using the second portion of the plurality of connectivity records.

12. The system of claim 11 , wherein the connectivity record is created using communication data representing at least one of: a socket-level communication, an active TCP communication, a port on which a computer is listening, IP communication information, configuration information, error log information, or detected behavior information.

13. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to at least:

determine a location associated with the communication represented by the connectivity record based at least partly on a subnet associated with the communication represented by the connectivity record; and

tag the connectivity record with data representing at least one of the subnet or the location.

14. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to at least:

determine that an address associated with the communication represented by the connectivity record is associated with a plurality of subnets; and

tag the connectivity record with data representing a subnet of the plurality of subnets having a fewest number of addresses.

15. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to generate service table data representing computing nodes offering computing services, wherein the source computing node is determined to be configured to offer the computing service based at least partly on the service table data.

16. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to determine that a first computing node of the plurality of computing nodes is offering a computing service based at least partly on the first computing node holding socket in a listening state.

17. The system of claim 16 , wherein the one or more processors are further configured by the computer-executable instructions to generate a service table record indicating the first computing node is offering the service, wherein the service table record comprises data representing a port number and a time interval that the first computing node is holding the socket in the listening state.

18. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to at least:

determine a quantity of times that a first computing node of the plurality of computing nodes communicates via a particular port; and

determine, based on the quantity satisfying a criterion, that the first computing node is offering a computing service.

19. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to identify an application based at least partly on a depth-first traversal of the graph, wherein the application is identified based at least partly on a subgraph representing a plurality of associated connectivity records.

20. The system of claim 11 , wherein the one or more processors are further configured by the computer-executable instructions to identify an application based at least partly on a breath-first traversal of the graph, wherein the application is identified based at least partly on a subgraph representing a plurality of associated connectivity records.

Assignments (7)