Correlating causes and effects associated with network activity
Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.
1. A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:
monitoring one or more portions of network traffic to provide one or more metrics associated with a plurality of entities in one or more networks;
employing the one or more portions of the network traffic to provide one or more activity profiles;
employing one or more models to determine one or more other activity profiles that correlate with the one or more activity profiles;
monitoring one or more other portions of the monitored network traffic based on the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic;
determining a score for each of the one or more models based on the occurrence of the one or more other portions of network traffic subsequent to the one or more portions of the network traffic;
determining the one or more models that require re-training based on the determined score having a value that is below a threshold value;
re-training the one or more determined models based on the network traffic; and
providing one or more reports to one or more users.
2. The method of claim 1 , wherein providing the one or more reports further comprises:
providing one or more interactive reports that enable feedback from the one or more users, wherein the feedback includes:
providing one or more ratings for the one or more models; and
providing one or more associations between the one or more models and one or more of notifications, events, priorities, or triggered actions.
3. The method of claim 1 , further comprising enabling the one or more users to selectively activate or deactivate the one or more models.
4. The method of claim 1 , further comprising providing one or more weights to one or more correlations determined between at least a portion of the one or more activity profiles and the one or more other activity profiles, wherein the one or more weights are based on an importance of a correlation to the one or more users.
5. The method of claim 1 , further comprising modifying the monitoring of the network traffic based on one or more correlations between the one or more activity profiles and the one or more other activity profiles, wherein the modifications include one or more of increasing monitoring detail, decreasing monitoring detail, collecting more metrics, collecting less metrics, capturing more data packets, or capturing less data packets.
6. The method of claim 1 , further comprising:
training the one or more models based on the network traffic and the one or more activity profiles, wherein the one or more models provide correlations that predict a likelihood of the occurrence of the one or more other portions of network traffic subsequent to the occurrence of the one or more portions of the network traffic based on one or more dependencies associated with the one or more activity profiles and the one or more other activity profiles.
7. A system for monitoring network traffic in a network:
one or more network computers, comprising:
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
monitoring one or more portions of network traffic to provide one or more metrics associated with a plurality of entities in one or more networks;
employing the one or more portions of the network traffic to provide one or more activity profiles;
employing one or more models to determine one or more other activity profiles that correlate with the one or more activity profiles;
monitoring one or more other portions of the monitored network traffic based on the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic;
determining a score for each of the one or more models based on the occurrence of the one or more other portions of network traffic subsequent to the one or more portions of the network traffic;
determining the one or more models that require re-training based on the determined score having a value that is below a threshold value;
re-training the one or more determined models based on the network traffic; and
providing one or more reports to one or more users; and
one or more client computers, comprising:
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
providing one or more portions of the monitored network traffic.
8. The system of claim 7 , wherein providing the one or more reports further comprises:
providing one or more interactive reports that enable feedback from the one or more users, wherein the feedback includes:
providing one or more ratings for the one or more models; and
providing one or more associations between the one or more models and one or more of notifications, events, priorities, or triggered actions.
9. The system of claim 7 , further comprising enabling the one or more users to selectively activate or deactivate the one or more models.
10. The system of claim 7 , further comprising providing one or more weights to one or more correlations determined between at least a portion of the one or more activity profiles and the one or more other activity profiles, wherein the one or more weights are based on an importance of a correlation to the one or more users.
11. The system of claim 7 , further comprising modifying the monitoring of the network traffic based on one or more correlations between the one or more activity profiles and the one or more other activity profiles, wherein the modifications include one or more of increasing monitoring detail, decreasing monitoring detail, collecting more metrics, collecting less metrics, capturing more data packets, or capturing less data packets.
12. The system of claim 7 , further comprising:
training the one or more models based on the network traffic and the one or more activity profiles, wherein the one or more models provide correlations that predict a likelihood of the occurrence of the one or more other portions of network traffic subsequent to the occurrence of the one or more portions of the network traffic based on one or more dependencies associated with the one or more activity profiles and the one or more other activity profiles.
13. A network computer for monitoring communication over a network between two or more computers, comprising:
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
monitoring one or more portions of network traffic to provide one or more metrics associated with a plurality of entities in one or more networks;
employing the one or more portions of the network traffic to provide one or more activity profiles;
employing one or more models to determine one or more other activity profiles that correlate with the one or more activity profiles;
monitoring one or more other portions of the monitored network traffic based on the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic;
determining a score for each of the one or more models based on the occurrence of the one or more other portions of network traffic subsequent to the one or more portions of the network traffic;
determining the one or more models that require re-training based on the determined score having a value that is below a threshold value;
re-training the one or more determined models based on the network traffic; and
providing one or more reports to one or more users.
14. The network computer of claim 13 , wherein providing the one or more reports further comprises:
providing one or more interactive reports that enable feedback from the one or more users, wherein the feedback includes:
providing one or more ratings for the one or more models; and
providing one or more associations between the one or more models and one or more of notifications, events, priorities, or triggered actions.
15. The network computer of claim 13 , further comprising enabling the one or more users to selectively activate or deactivate the one or more models.
16. The network computer of claim 13 , further comprising providing one or more weights to one or more correlations determined between at least a portion of the one or more activity profiles and the one or more other activity profiles, wherein the one or more weights are based on an importance of a correlation to the one or more users.
17. The network computer of claim 13 , further comprising modifying the monitoring of the network traffic based on one or more correlations between the one or more activity profiles and the one or more other activity profiles, wherein the modifications include one or more of increasing monitoring detail, decreasing monitoring detail, collecting more metrics, collecting less metrics, capturing more data packets, or capturing less data packets.
18. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:
monitoring one or more portions of network traffic to provide one or more metrics associated with a plurality of entities in one or more networks;
employing the one or more portions of the network traffic to provide one or more activity profiles;
employing one or more models to determine one or more other activity profiles that correlate with the one or more activity profiles;
monitoring one or more other portions of the monitored network traffic based on the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic;
determining a score for each of the one or more models based on the occurrence of the one or more other portions of network traffic subsequent to the one or more portions of the network traffic;
determining the one or more models that require re-training based on the determined score having a value that is below a threshold value;
re-training the one or more determined models based on the network traffic; and
providing one or more reports to one or more users.