US 11,757,740 B2
Aggregation of select network traffic statistics
David Anthony Hughes, Los Altos Hills, CA (US); and Pawan Kumar Singh, Los Altos, CA (US)
Assigned to Hewlett Packard Enterprise Development LP, Spring, TX (US)
Filed by HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, Houston, TX (US)
Filed on Jan. 28, 2021, as Appl. No. 17/161,286.
Application 17/161,286 is a continuation of application No. 16/581,637, filed on Sep. 24, 2019, abandoned.
Application 16/581,637 is a continuation of application No. 15/180,981, filed on Jun. 13, 2016, granted, now 10,432,484, issued on Oct. 1, 2019.
Prior Publication US 2021/0152445 A1, May 20, 2021
Int. Cl. H04L 43/062 (2022.01); H04L 43/045 (2022.01); H04L 43/067 (2022.01); G06F 16/22 (2019.01); G06F 16/248 (2019.01); G06F 16/28 (2019.01); H04L 43/026 (2022.01)
CPC H04L 43/062 (2013.01) [G06F 16/22 (2019.01); G06F 16/248 (2019.01); G06F 16/284 (2019.01); H04L 43/026 (2013.01); H04L 43/045 (2013.01); H04L 43/067 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for generating network traffic statistics comprising:
receiving, at a network information collector device via a network, an accumulating map from a network appliance device, wherein the accumulating map comprises a condensed and aggregated version of web traffic flow information to the network appliance device, the accumulating map being generated by:
for each flow from a first network appliance device, extracting a first attribute value of a first flow attribute,
for each flow from the first network appliance device, extracting a second attribute value of a second flow attribute,
building a hierarchical string with the extracted first attribute value and the extracted second attribute value, wherein the hierarchical string represents a subset of the network traffic statistics collected for the first network appliance device, and the second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string,
extracting at least one network metric for at least one network characteristic associated with the at least one hierarchical string,
aggregating the at least one network metric for the at least one network characteristic over a plurality of flows to and from the first network appliance device in the network,
implementing an eviction policy on lower level records and aggregating the lower level records into a higher level record of the hierarchical string, and
generating the accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for the first flow attribute and the second flow attribute of the hierarchical string,
the accumulating map being limited to a defined number of entries for a specified time period, and
the defined number of entries for the specified time period reducing an amount of the web traffic flow information collected;
receiving, at the network information collector device via the network, additional accumulating maps from other network appliance devices;
populating an accumulation map database with the accumulating map and the additional accumulating maps; and
generating a report of the network traffic statistics hosted by the network appliance device and the other network appliance devices.