UNSUPERVISED MACHINE LEARNING FOR CLUSTERING DATACENTER NODES ON THE BASIS OF NETWORK TRAFFIC PATTERNS

摘要

For a managed network including multiple nodes providing multiple services and executing multiple applications some embodiments provide a method for generating groupings of network addresses associated with different applications or services. The method analyzes network traffic patterns using a probabilistic topic modeling algorithm to generate the groupings of network addresses. Network traffic patterns are related to the different flows in the network. The method analyzes information about the different flows such as some combination of the network addresses in the network that are a source or destination of the flow, the source or destination port, the number of packets in each flow, the number of bytes exchanged during the life of the flow, a start time of a flow, and the duration of the flow. In some embodiments, the information is collected as part of an internet protocol flow information export (IPFIX) operation or a tcpdump operation.