Enriched flow data for network analytics

Abstract

Systems and methods provide for enriching flow data to analyze network security, availability, and compliance. A network analytics system can capture flow data and metadata from network elements. The network analytics system can enrich the flow data by in-line association of the flow data and metadata. The network analytics system can generate multiple planes with each plane representing a dimension of enriched flow data. The network analytics system can generate nodes for the planes with each node representing a unique value or set of values for the dimensions represented by planes. The network analytics system can generate edges for the nodes of the planes with each edge representing a flow between endpoints corresponding to the nodes. The network analytics system can update the planes in response to an interaction with the planes or in response to a query.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 capturing flow data associated with network traffic in a flow domain and network telemetry associated with out-of-band network domains, wherein the network telemetry includes contextual information regarding network traffic outside of the flow domain;   associating the flow data associated with the network traffic in the flow domain and the contextual information regarding the network traffic outside of the flow domain from the network telemetry associated with the out-of-band network domains;   storing the association between the flow data and the network telemetry with network elements; and   generating a user interface configured to visualize the association between the flow data and the network telemetry.   
     
     
         2 . The method of  claim 1 , wherein the network telemetry is obtained by one or more software or hardware sensors. 
     
     
         3 . The method of  claim 1 , wherein the generating the user interface includes:
 isolating the flow data associated with the network telemetry, by one or more dimensions of conventional flow data and one or more dimensions of the network telemetry.   
     
     
         4 . The method of  claim 1 , wherein the visualized association between the flow data and the network telemetry includes one or more planes, wherein each of the one or more planes represent at least one attribute of the flow data associated with the network telemetry. 
     
     
         5 . The method of  claim 4 , wherein the visualized association is a graph of each plane of the one or more planes, wherein nodes of the graph represent different values of the at least one attribute of the flow data associated with the network telemetry and lines of the graph represent flows between endpoints corresponding to the nodes. 
     
     
         6 . The method of  claim 4 , further comprising:
 updating the one or more planes in response to an input.   
     
     
         7 . The method of  claim 6 , wherein the updating the one or more planes includes at least one of combining two or more of the planes into a single plane or dividing at least one of the planes into multiple planes. 
     
     
         8 . The method of  claim 1 , wherein the visualized association between the flow data and the network telemetry includes one or more planes representing at least one attribute of the flow data, the method further comprising:
 updating the one or more planes in response to an interaction with one or more of the planes, wherein the interaction is one of panning, tilting, rotating, zooming in, zooming out, reordering, shuffling, removing, or occluding at least one plane.   
     
     
         9 . The method of  claim 1 , further comprising:
 combining multiple dimensions of the flow data associated with the network telemetry during the association based on a unary search tree.   
     
     
         10 . The method of  claim 1 , further comprising:
 extracting the network telemetry associated with the out-of-band network domains from a network device configuration.   
     
     
         11 . A system for enriching flow data, the system comprising:
 one or more processors; and   a computer-readable medium comprising instructions stored therein, which when executed by the processors, cause the processors to:
 capture flow data associated with network traffic in a flow data domain and network telemetry associated with out-of-band network domains, wherein the network telemetry includes contextual information regarding network traffic outside of the flow data domain; 
 associate the flow data associated with the network traffic in the flow domain and the contextual information regarding the network traffic outside of the flow domain from the network telemetry associated with the out-of-band network domains; 
 store the association between the flow data and the network telemetry with network elements; and 
 generate a user interface configured to visualize the association between the flow data and the network telemetry. 
   
     
     
         12 . The system of  claim 11 , further comprising instructions which when executed cause the one or more processors to:
 isolate the flow data associated with the network telemetry, by one or more dimensions of conventional flow data and one or more dimensions of the network telemetry.   
     
     
         13 . The system of  claim 11 , wherein the visualized association between the flow data and the network telemetry includes one or more planes, wherein each of the one or more planes represents at least one attribute of the flow data associated with the network telemetry. 
     
     
         14 . The system of  claim 13 , wherein the visualized association is a graph of each plane of the one or more planes, wherein nodes of the graph represent different values of the at least one attribute of the flow data associated with the network telemetry and lines of the graph represent flows between endpoints corresponding to the nodes. 
     
     
         15 . The system of  claim 13 , further comprising instructions which when executed cause the one or more processors to:
 update the one or more planes in response to an input.   
     
     
         16 . The system of  claim 11 , wherein the visualized association between the flow data and the network telemetry includes one or more planes representing at least one attribute of the flow data, and further comprising instructions which when executed cause the one or more processors to: updating the one or more planes in response to an interaction with one or more of the planes, wherein the interaction is one of panning, tilting, rotating, zooming in, zooming out, reordering, shuffling, removing, or occluding at least one plane. 
     
     
         17 . A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the processors to:
 capture flow data associated with network traffic in a flow data domain and network telemetry associated with out-of-band network domains, wherein the network telemetry includes contextual information regarding network traffic outside of the flow data domain;   associate the flow data associated with the network traffic in the flow domain and the contextual information regarding the network traffic outside of the flow domain from the network telemetry associated with the out-of-band network domains;   storing the association between the flow data and the network telemetry with network elements; and   generate a user interface configured to visualize the association between the flow data and the network telemetry.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 17 , further comprising instructions which when executed cause the one or more processors to:
 generate multiple planes, each plane representing at least one attribute of the flow data; and   generate a graph for each plane of the multiple planes in which nodes of the graph represent different values of the at least one attribute of the flow data and lines of the graph represent flows between endpoints corresponding to the nodes.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 18 , further comprising instructions which when executed cause the one or more processors to:
 update one or more of the planes in response to an input.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 17 , wherein the visualized association between the flow data and the network telemetry includes one or more planes, wherein each of the one or more planes represents at least one attribute of the flow data associated with the network telemetry.