System and method for observing and controlling a programmable network via higher layer attributes

1. A system for simultaneously and centrally analyzing a plurality of networks, the system comprising:

a non-transitory computer readable collector memory;

one or more collectors configured to receive network traffic data from a plurality of network elements in the plurality of networks, wherein a first network of the plurality of networks is from a first company and a second network of the plurality of networks is from a second company, wherein the one or more collectors are stored in the non-transitory computer readable collector memory that is executed by a collector processor;

a programmable network element that is a programmable switch, router, or wireless access point;

a non-transitory computer readable manager memory; and

a remote network manager configured to receive metadata from the one or more collectors, and further configured to simultaneously and centrally analyze (1) the network traffic data from the plurality of network elements in the plurality of networks and (2) network management data from a plurality of enterprise systems in the plurality of networks, wherein the network management data includes L1 through L7 network topology data, network configuration data, and simple network management protocol data, wherein the remote network manager is stored in the non-transitory computer readable manager memory that is executed by a manager processor;

wherein the remote network manager combines the network traffic data from the plurality of networks and the network management data from the plurality of enterprise systems in the plurality of networks into combined cross-network data from multiple companies for simultaneous and central analysis of the combined cross-network data from the multiple companies,

wherein the remote network manager identifies a network control objective for the network, identifies a programmable parameter of the programmable network element to achieve the network control objective, and programs the programmable network element, wherein the network control objective is security or performance remediation,

wherein the remote network manager identifies specific users, applications, and devices causing security or performance issues, and wherein the programmable parameter identified by the remote network manager is blocking the specific users, applications, and devices causing the security or performance issues,

wherein the system implements control policies that summarize and index higher layer information about users, applications, devices, and behaviors using machine learning, wherein the higher layer information is queryable using natural language processing, and wherein the control policies automatically adjust to changes in network topology.

2. The system of claim 1 , wherein the system learns a pattern by identifying specific network, protocol, and wireless metrics to determine application performance.

3. The system of claim 1 , wherein the one or more collectors receive mirror traffic data from the plurality of network elements.

4. The system of claim 1 , wherein the one or more collectors are further configured to index the network enabling efficient search and retrieval of the metadata.

5. The system of claim 1 , wherein the remote network manager is disposed in a cloud.

6. The system of claim 1 , wherein the one or more collectors program the programmable network element to configure the programmable network element to send filtered network traffic data to the one or more collectors.

7. The system of claim 1 , wherein network analysis is performed using the metadata.

8. The system of claim 1 , wherein a control loop is applied to determine whether a network control objective is met after programming the programmable network element.

9. The system of claim 1 , wherein the one or more collectors are further configured to receive statistics about the network, topology information about the network, input from one or more enterprise systems, or combinations thereof.

10. The system of claim 9 , wherein the metadata received from the network traffic data is time-aligned with data received from the one or more enterprise systems.

11. The system of claim 1 , wherein the remote network manager programs the programmable network element to configure the programmable network element to send filtered network traffic data to the one or more collectors.

12. The system of claim 1 , wherein the remote network manager affects a network policy by programming a programmable network element with a control primitive, wherein the control primitive includes an access control list (ACL), quality of service (QoS), rate limit settings, or combinations thereof.

13. The system of claim 12 , wherein the remote network manager maintains a relationship between a network policy and the control primitive in a database.

14. The system of claim 1 , wherein the remote network manager de-duplicates the metadata received from the one or more collectors.

15. The system of claim 1 , wherein the remote network manager calculates a quality of experience of a user, an application, or a device, based on the metadata received from the one or more collectors.

16. A method for simultaneously and centrally analyzing a plurality of networks, the system comprising:

accessing a non-transitory computer readable collector memory;

accessing one or more collectors configured to receive network traffic data from a plurality of network elements in the plurality of networks, wherein a first network of the plurality of networks is from a first company and a second network of the plurality of networks is from a second company, wherein the one or more collectors are stored in the non-transitory computer readable collector memory that is executed by a collector processor;

accessing a programmable network element;

providing a non-transitory computer readable manager memory;

providing a remote network manager configured to simultaneously and centrally analyze (1) the network traffic data from the plurality of network elements in the plurality of networks and (2) network management data from a plurality of enterprise systems in the plurality of networks, wherein the network management data includes L1 through L7 network topology data, network configuration data, and simple network management protocol data, wherein the remote network manager is stored in the non-transitory computer readable manager memory that is executed by a manager processor, wherein the remote network manager combines the network traffic data from the plurality of networks and the network management data from the plurality of enterprise systems in the plurality of networks into combined cross-network data from multiple companies for simultaneous and central analysis of the combined cross-network data from the multiple companies;

identifying, using the remote network manager, a network control objective for the network and a programmable parameter of the programmable network element to achieve the network control objective, wherein the remote network manager identifies specific users, applications, and devices causing security or performance issues; and

programming the programmable network element with the programmable parameter based on the metadata received from the plurality of network elements in the network, wherein the network control objective is security or performance remediation, and wherein the programmable parameter identified by the remote network manager is blocking the specific users, applications, and devices causing the security or performance issues,

wherein the system implements control policies that summarize and index higher layer information about users, applications, devices, and behaviors using machine learning, wherein the higher layer information is queryable using natural language processing, and wherein the control policies automatically adjust to changes in network topology.

17. The system of claim 1 , wherein the system extracts features from the network traffic data, summarizes data regarding extracted higher layer information from the network traffic data, and indexes the summarized data in a database for pattern identification.

18. The system of claim 17 , wherein the higher layer information includes a relationship or binding of higher layer data to lower layer data, wherein higher layer data corresponds to users, applications, devices, or combinations thereof, and wherein lower layer data corresponds to IP and MAC addresses, ports, or combinations thereof.

19. The system of claim 1 , wherein the control policies account for network topology and capabilities to enforce a security policy as close to an edge of the network as possible, instead of at logical or physical network choke points.

20. The system of claim 11 , wherein the one or more collectors are programmable, and wherein the remote network manager programs the one or more collectors to collect different types of metadata.