Systems and methods for efficient network conversation bandwidth statistics gathering

摘要

Computer networks are monitored for usage and security purposes. A network intercept device (NID) monitors network traffic such as conversations between source and destination endpoints in the network. Bandwidth usage statistics may be maintained for each monitored endpoint (e.g. by source IP address). Rather than determining statistics for all active conversations during a particular monitoring period, which comprehensive statistics determining may tax NID processing and storage resources, statistics for a “top” number of conversations (N) may be determined. A lossy approach may be used to gather statistics over the period for up to N conversations of each monitored endpoint. When a new conversation commences during the period for which statistics are not being gathered, each of the monitored endpoint's conversations may be decayed. The new conversation is added for statistics gathering, replacing one of the N conversations, when the one conversation has sufficiently decayed to or below a threshold.