Collecting asymmetric data and proxy data on a communication network

摘要

A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. A metadata portion of at least one of the data streams is analyzed on the network and evaluated using a metadata processing engine to identify a relationship between at least two of the plurality of data streams, e.g., a relationship between multiple users of interest, a new user of interest, etc. Evaluation of the metadata and the relationships can be performed algorithmically, as predetermined by an analyst or as provided as preset options by the network monitoring system (NMS). An interface manager can receive the new user of interest, evaluate the new user of interest for redundancy against existing users of interest of the NMS; then communicate the new user of interest to at least one access device to collect data streams associated with the new user of interest.

主权项

1. A method comprising:
capturing, through a multi-tenant capable Network Monitoring System (NMS) configured to monitor users of a computer network, a data stream solely related to a known user of interest among the users of the computer network, the captured data stream being related to activity of the known user of interest on the computer network; identifying, through at least one processor of the NMS communicatively coupled to at least one memory, a type of an application being employed by the known user of interest based on analyzing the captured data stream; generating, through the at least one processor, a new search term unique to an asymmetric data stream of the captured data stream based on an upper layer of a communication protocol used by the captured data stream, an application protocol associated with the identified application, content within the captured data stream and identification of the known user of interest, the asymmetric data stream being related to network communication on part of the known user of interest that is asymmetric in terms of at least one of: a time communicated on the computer network, a source providing data related to the captured data stream onto the computer network, a route chosen on the computer network to send the data related to the captured data stream, an application type and protocol used to package and format the data related to the captured data stream in packets sent on the computer network, data related to web services used by the known user of interest, data related to non-web services used by the known user of interest, data sent through a network different from the computer network but associated therewith, a response to a communication on the computer network on part of the known user of interest, data sent via a route that is different from a route requested on behalf of the known user of interest and proxy data associated with the known user of interest; broadcasting the new search term to a plurality of probes located in the computer network, each probe of the plurality of probes being associated with a portion of the computer network where at least one of: a different routing and an aggregation point exists compared to an original form thereof; and collecting the asymmetric data stream of the captured data stream based on the broadcasting of the new search term and utilization of the plurality of probes located in the computer network.