Monitoring and analysis of interactions between network endpoints
Techniques for monitoring and analysis of interactions between network endpoints are disclosed. In some embodiments, a process for monitoring and analysis of interactions between network endpoints includes collecting Domain Name System (DNS) response data from a network device; determining network endpoint interactions based on an analysis of the DNS response data (e.g., using a processor); and generating a graph corresponding to the network endpoint interactions. For example, the network device can include a DNS device and/or a software-defined networking (SDN) device (e.g., an SDN switch, such as an OpenFlow switch).
1. A system for monitoring and analysis of interactions between network endpoints, comprising:
a processor configured to:
collect Domain Name System (DNS) response data from a network device, comprising to:
identify DNS responses from the network device that match User Datagram Protocol (UDP) port 53;
determine network endpoint interactions based on an analysis of the DNS response data;
generate a graph corresponding to the network endpoint interactions;
group, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
determine whether anomalous network activity has occurred based on an analysis of the generated graph, comprising to:
compare a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and
in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determine that the anomalous network activity has occurred; and
in response to a determination that the anomalous network activity has occurred, perform a remedial action; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the network device includes a DNS device.
3. The system of claim 1 , wherein the network device includes a software-defined networking (SDN) device.
4. The system of claim 1 , wherein the network device includes a DNS device and/or a software-defined networking (SDN) device.
5. The system of claim 1 , wherein the network device includes a software-defined networking (SDN) switch.
6. The system of claim 1 , wherein the network device includes an OpenFlow switch.
7. The system of claim 1 , wherein the processor is further configured to:
store the DNS response data in a data store.
8. The system of claim 1 , wherein the processor is further configured to:
execute a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device.
9. The system of claim 1 , wherein the processor is further configured to:
configure a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform.
10. The system of claim 1 , wherein the processor is further configured to:
generate a report based on an analysis of the network endpoint interactions for a plurality of network endpoints internal to an enterprise network.
11. A method for monitoring and analysis of interactions between network endpoints, comprising:
collecting Domain Name System (DNS) response data from a network device, comprising:
identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53;
determining network endpoint interactions based on an analysis of the DNS response data;
generating a graph corresponding to the network endpoint interactions;
grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and
in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and
in response to a determination that the anomalous network activity has occurred, performing a remedial action.
12. The method of claim 11 , wherein the network device includes a DNS device and/or a software-defined networking (SDN) device.
13. The method of claim 11 , further comprising:
storing the DNS response data in a data store.
14. The method of claim 11 , further comprising:
executing a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device.
15. The method of claim 11 , further comprising:
configuring a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform.
16. A computer program product for monitoring and analysis of interactions between network endpoints, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
collecting Domain Name System (DNS) response data from a network device, comprising:
identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53;
determining network endpoint interactions based on an analysis of the DNS response data;
generating a graph corresponding to the network endpoint interactions;
grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and
in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and
in response to a determination that the anomalous network activity has occurred, performing a remedial action.
17. The computer program product recited in claim 16 , wherein the network device includes a DNS device and/or a software-defined networking (SDN) device.
18. The computer program product recited in claim 16 , further comprising computer instructions for:
storing the DNS response data in a data store.
19. The computer program product recited in claim 16 , further comprising computer instructions for:
executing a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device.
20. The computer program product recited in claim 16 , further comprising computer instructions for:
configuring a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform.
21. A system for monitoring and analysis of interactions between network endpoints, comprising:
a controller for collecting network data from a plurality of network devices in an enterprise network, wherein the collecting of the network data comprises identifying DNS responses from the plurality of network devices that match User Datagram Protocol (UDP) port 53;
a data store in communication with the controller for storing the network data;
an analyzer in communication with the data store for performing an analysis of the network data to determine interactions between network endpoints;
a graphics visualizer in communication with the analyzer for generating a graph based on the interactions between network endpoints, and grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions; and
a determiner in communication with the graphics visualize for determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and
in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and
in response to a determination that the anomalous network activity has occurred, performing a remedial action.
22. The system of claim 21 , wherein the plurality of network devices includes physical network devices, virtual network devices, and/or software-defined networking (SDN) devices.
23. The system of claim 21 , wherein the network data includes Domain Name System (DNS) responses.
24. The system of claim 21 , further comprising: a data aggregator in communication with the controller for aggregating the network data.
25. The system of claim 21 , further comprising: a web server in communication with the analyzer for web-based network communications with the system.