Methods, systems, and computer readable media for detecting network service anomalies
Methods, systems, and computer readable media for detecting network service anomalies. An example method includes, during a learning phase, detecting a client initiating a first network interaction with an application and recording a start time for the first network interaction with the application; determining that the first network interaction with the application has ceased and recording an end time for the first network interaction; and determining, based on the start time and the end time, an application interaction rate for the first network interaction with the application. The method includes, during a detection phase, detecting the client initiating a second network interaction with the application; determining a second application interaction rate for the second network interaction; and determining that a network service anomaly occurred during the second network interaction based on the first application interaction rate and the second application interaction rate.
1. A method for detecting network service anomalies, the method comprising:
during a learning phase:
detecting a client initiating a first network interaction with an application and recording a start time for the first network interaction with the application;
determining that the first network interaction with the application has ceased and recording an end time for the first network interaction; and
determining, based on the start time and the end time, a first application interaction rate for the first network interaction with the application; and
during a detection phase:
detecting the client initiating a second network interaction with the application;
determining a second application interaction rate for the second network interaction; and
determining that a network service anomaly occurred during the second network interaction based on the first application interaction rate and the second application interaction rate, wherein determining that the network service anomaly occurred comprises determining that the second network interaction has ceased, building a feature vector comprising the second application interaction rate and one or more other metrics observed during the second network interaction, supplying the feature vector to a machine learning model trained on one or more previous interactions with the application, and using an output of the machine learning model to determine that the network service anomaly occurred during the second network interaction.
2. The method of claim 1 , wherein the first network interaction with the application comprises a plurality of different encrypted connections between the client and a plurality of application servers within a network domain for the application.
3. The method of claim 1 , wherein determining that the first network interaction with the application has ceased comprises determining that all connections to the application have ceased for at least a threshold amount of time.
4. The method of claim 1 , wherein detecting a client initiating a first network interaction with an application comprises performing transport layer security (TLS) parsing to identify an application name for the application from an encrypted connection.
5. The method of claim 1 , wherein the machine learning model is trained on one or more previous interactions with the application for a first geographic region, and wherein the method comprises determining that the client is located with the first geographic region.
6. The method of claim 1 , wherein the machine learning model is trained on one or more previous interactions with the application for a day of the week, and wherein the method comprises determining that the second client interaction occurred during the day of the week.
7. The method of claim 1 , wherein building the feature vector comprises measuring one or more of: application response time, connection lifetime, bitrate, total bytes, number of packets, a packet size distribution, and a number of connections.
8. The method of claim 1 , wherein building the feature vector comprises including one or more feature time window metrics characterizing a window of time at an end of the second network interaction.
9. The method of claim 1 , comprising outputting a total mean squared error (MSE) score for the feature vector and one or more feature-specific MSE scores.
10. A system for detecting network service anomalies, the system comprising:
one or more processors and memory storing executable instructions for the one or more processors;
a visibility behavior analysis system (VBAS) implemented on the one or more processors and configured for:
during a learning phase:
detecting a client initiating a first network interaction with an application and recording a start time for the first network interaction with the application;
determining that the first network interaction with the application has ceased and recording an end time for the first network interaction; and
determining, based on the start time and the end time, a first application interaction rate for the first network interaction with the application; and
during a detection phase:
detecting the client initiating a second network interaction with the application;
determining a second application interaction rate for the second network interaction; and
determining that a network service anomaly occurred during the second network interaction based on the first application interaction rate and the second application interaction rate, wherein determining that the network service anomaly occurred comprises determining that the second network interaction has ceased, building a feature vector comprising the second application interaction rate and one or more other metrics observed during the second network interaction, supplying the feature vector to a machine learning model trained on one or more previous interactions with the application, and using an output of the machine learning model to determine that the network service anomaly occurred during the second network interaction.
11. The system of claim 10 , wherein the first network interaction with the application comprises a plurality of different encrypted connections between the client and a plurality of application servers within a network domain for the application.
12. The system of claim 10 , wherein determining that the first network interaction with the application has ceased comprises determining that all connections to the application have ceased for at least a threshold amount of time.
13. The system of claim 10 , wherein detecting a client initiating a first network interaction with an application comprises performing transport layer security (TLS) parsing to identify an application name for the application from an encrypted connection.
14. The system of claim 10 , wherein the machine learning model is trained on one or more previous interactions with the application for a first geographic region, and wherein the VBAS is configured for determining that the client is located with the first geographic region.
15. The system of claim 10 , wherein the machine learning model is trained on one or more previous interactions with the application for a day of the week, and wherein the VBAS is configured for determining that the second client interaction occurred during the day of the week.
16. The system of claim 10 , wherein building the feature vector comprises measuring one or more of: application response time, connection lifetime, bitrate, total bytes, number of packets, a packet size distribution, and a number of connections.
17. The system of claim 10 , wherein building the feature vector comprises including one or more feature time window metrics characterizing a window of time at an end of the second network interaction.
18. The system of claim 10 , wherein the VBAS is configured for outputting a total mean squared error (MSE) score for the feature vector and one or more feature-specific MSE scores.