Mapping network service dependencies

1. A method for discovering a service dependency chain in a data network without any active injection of data traffic, the method comprising:

providing a network manager running on a processor unit and connected to the data network, the network manager configured to perform the following steps:

discovering service dependencies;

identifying a potential service dependency chain based on at least a portion of the service dependencies;

building a number of data paths for the potential service dependency chain;

computing a chain transfer entropy for the potential service dependency chain based on the number of data paths; and

determining whether the potential service dependency chain is the service dependency chain based on the chain transfer entropy;

wherein the network manager compares the discovered service dependencies to baseline service dependencies and compares the service dependency chain to a baseline service dependency chain in order to detect attacks and deviations from normal operations of the network.

2. The method of claim 1 , wherein building the number of data paths comprises:

building a data path over a path time period.

3. The method of claim 1 , wherein building the number of data paths comprises:

building a forward path; and

building a return path, wherein the forward path and the return path form a data path in the number of data paths.

4. The method of claim 1 , wherein building the number of data paths comprises:

building a forward path for a data path in the number of data paths from an initial service to a final service; and

representing the forward path using W(t), wherein W(t) is an amount of information that is initially sent from the initial service to a service along the forward path.

5. The method of claim 4 , wherein building the number of data paths further comprises:

building a return path for the data path in the number of data paths from the final service to the initial service; and

representing the return path using Z(t), wherein Z(t) is a minimum amount of information that is sent from one service to another service along the return path.

6. The method of claim 1 , wherein determining whether the potential service dependency chain is the service dependency chain based on the chain transfer entropy comprises:

comparing the chain transfer entropy to a selected threshold.

7. The method of claim 1 , wherein determining whether the potential service dependency chain is the service dependency chain based on the chain transfer entropy comprises:

determining that the potential service dependency chain represents the service dependency chain when the chain transfer entropy is greater than or equal to a selected threshold.

8. The method of claim 1 , wherein identifying the potential service dependency chain comprises:

identifying a group of service dependencies formed by n services based on at least a portion of the service dependencies discovered.

9. The method of claim 1 , wherein discovering the service dependencies comprises:

identifying a plurality of connections between nodes in a data network.

10. The method of claim 9 , wherein discovering the service dependencies further comprises:

identifying a set of connection pairs based on the plurality of connections identified.

11. The method of claim 10 , wherein discovering the service dependencies further comprises:

creating a set of time series for the set of connection pairs using monitoring data received from a plurality of sensors monitoring the data network.

12. The method of claim 11 , wherein discovering the service dependencies further comprises:

discovering the service dependencies using the set of time series.

13. The method of claim 12 , wherein the network manager is configured to run on a processor unit and to discover the service dependency chain without any active injection of data traffic.

14. The method of claim 1 , wherein the service dependencies are discovered using data from a number of sensors in a network.

15. The method of claim 1 , further comprising:

computing chain transfer entropies for the number of data paths;

computing a cumulative distribution function of the chain transfer entropies for the number of data paths; and

determining that the potential service dependency chain is the service dependency chain when the chain transfer entropy is greater than the cumulative distribution function.

16. A method for discovering a service dependency chain between three or more services, the method comprising:

providing a network manager running on a processor unit and connected to the data network, the network manager configured to perform the following steps:

discovering service dependencies;

identifying a potential service dependency chain based on at least a portion of the service dependencies;

building a number of data paths for the potential service dependency chain, wherein a data path in the number of data paths includes a forward path and a return path that both fall within a path time period;

computing a chain transfer entropy for the potential service dependency chain based on the number of data paths; and

determining whether the potential service dependency chain is the service dependency chain based on the chain transfer entropy;

wherein the network manager compares the discovered service dependencies to baseline service dependencies and compares the service dependency chain to a baseline service dependency chain in order to detect attacks and deviations from normal operations of the network.

17. The method of claim 16 , wherein building the number of data paths comprises:

building the forward path for the data path in the number of data paths from an initial service to a final service; and

representing the forward path using W(t), wherein W(t) is a piece of information that is initially sent from the initial service.

18. The method of claim 17 , wherein building the number of data paths further comprises:

building the return path for the data path in the number of data paths from the final service to the initial service; and

representing the return path using Z(t), wherein Z(t) is a minimum amount of information that is sent from one service to another service along the return path.

19. The method of claim 16 , wherein discovering the service dependencies comprises:

identifying a plurality of connections between nodes in a data network;

identifying a set of connection pairs based on the plurality of connections identified;

creating a set of time series for the set of connection pairs using monitoring data received from a plurality of sensors monitoring the data network; and

discovering the service dependencies using the set of time series.

20. The method of claim 16 , wherein the service dependencies are discovered using data from a number of sensors in a network.

21. The method of claim 16 , further comprising:

computing chain transfer entropies for the number of data paths;

computing a cumulative distribution function of the chain transfer entropies for the number of data paths; and

determining that the potential service dependency chain is the service dependency chain when the chain transfer entropy is greater than the cumulative distribution function.

22. An apparatus comprising:

a network manager, running on a processor unit in a data network having a number of client devices and a number of service devices, that discovers service dependencies, the network manager receiving data from a number of sensors; responsive to receiving the data, the network manager identifies a potential service dependency chain based on at least a portion of the service dependencies; builds a number of data paths for the potential service dependency chain; computes a chain transfer entropy for the potential service dependency chain based on the number of data paths; and determines that the potential service dependency chain is the service dependency chain when the chain transfer entropy of the potential service dependency chain is greater than a cumulative distribution function of the chain transfer entropies for the number of data paths; wherein the network manager compares the discovered service dependencies to baseline service dependencies and compares the service dependency chain to a baseline service dependency chain in order to detect attacks and deviations from normal operations of the network.

23. The apparatus of claim 22 , wherein a data path in the number of data paths includes a forward path and a return path.

24. The apparatus of claim 23 , wherein the forward path is represented using W(t) in which W(t) is a piece of information that is initially sent from an initial service and wherein the return path is represented using Z(t) in which Z(t) is a minimum amount of information that is sent from one service to another service along the return path.

25. The apparatus of claim 22 , wherein the network manager comprises:

a connection manager that identifies a plurality of connections between nodes in a data network and that identifies a set of connection pairs based on the plurality of connections identified;

a time series builder that creates a set of time series for the set of connection pairs; and

a dependency evaluator that discovers the service dependencies in the data network using the set of time series.

26. The apparatus of claim 22 , wherein the network manager is configured to run on a processor unit and to discover the service dependency chain without any active injection of data traffic.