Analysis of data flows in complex enterprise it environments

Abstract

The present technology enables identification, visualization, and analysis of data flows via network components in complex enterprise IT environments including but not limited to servers, workstations, switches, routers, wireless access points, traffic shapers, firewalls, storage systems and SAN systems. A method and system provide accessing collected information, filtering network connections from the information, identifying data flows over the filtered network connections, mapping the data flows to network components to find paths, marking the data flows and the network components associated with the paths with attributes, and displaying a networked computer environment including the filtered network connections, and the marked data flows and the marked network components associated with the paths.

1 . A computer-implemented method for identifying, visualizing, and analyzing a networked computer environment, the method comprising:
 accessing collected information about the networked computer environment, including network topology of network components and network connections via a network topology graph, network component dependencies, configurations, and attributes, software components, software objects, and data objects;   filtering one or more of the network connections from the information collected based on the software components, software objects, and data objects of certain types that are accessed via the network connections, thus resulting in filtered network connections;   identifying data flows between the software components, software objects, and data objects of the certain types over the filtered network connections;   mapping the data flows over the filtered network connections to the network components via the network topology graph in order to find paths between the software components, software objects, and data objects of the certain types, wherein each of the paths includes a set of the data flows mapped to a respective set of the network components;   marking the set of the data flows included in each of the paths with one or more attributes of the software components, software objects, and data objects of the certain types associated with each of the paths, thus resulting in marked data flows associated with each of the paths;   marking the respective set of the network components included in each of the paths with the one or more attributes of the marked data flows, thus resulting in marked network components associated with each of the paths; and   displaying the networked computer environment including the filtered network connections, and the marked data flows and the marked network components associated with each of the paths.   
     
     
         2 . The computer-implemented method according to  claim 1 , wherein the method further comprises collecting the information about the networked computer environment, including network topology of network components and network connections via the network topology graph, network component dependencies, configurations, and attributes, software components, software objects, and data objects. 
     
     
         3 . The computer-implemented method according to  claim 1 , wherein finding paths between the software components, software objects, and data objects via the network topology graph is performed using a depth-first graph search algorithm. 
     
     
         4 . The computer-implemented method according to  claim 1 , wherein finding paths between the software components, software objects, and data objects further comprises:
 analyzing routing and firewall rules of the network components as filtered; and   excluding network connections as filtered from mapping of the data flows according to the routing and firewall rules.   
     
     
         5 . The computer-implemented method according to  claim 1 , wherein the method further comprises:
 defining and organizing data environments, security environments, and security zones to include the marked network components;   defining firewalls for the data environments, security environments, and security zones; and   displaying the networked computer environment including the data environments, security environments, and security zones, filtered network connections, and the marked data flows and the marked network components associated with each of the paths.   
     
     
         6 . A computer-implemented system to identify, visualize, and analyze a networked computer environment, the system comprising:
 a processing device; and   a memory storing instructions that, when executed by the processing device, cause the processing device to perform operations comprising:
 accessing collected information about the networked computer environment, including network topology of network components and network connections via a network topology graph, network component dependencies, configurations, and attributes, software components, software objects, and data objects; 
 filtering one or more of the network connections from the information collected based on the software components, software objects, and data objects of certain types that are accessed via the network connections, thus resulting in filtered network connections; 
 identifying data flows between the software components, software objects, and data objects of the certain types over the filtered network connections; 
 mapping the data flows over the filtered network connections to the network components via the network topology graph in order to find paths between the software components, software objects, and data objects of the certain types, wherein each of the paths includes a set of the data flows mapped to a respective set of the network components; 
 marking the set of the data flows included in each of the paths with one or more attributes of the software components, software objects, and data objects of the certain types associated with each of the paths, thus resulting in marked data flows associated with each of the paths; 
 marking the respective set of the network components included in each of the paths with the one or more attributes of the marked data flows, thus resulting in marked network components associated with each of the paths; and 
 displaying the networked computer environment including the filtered network connections, and the marked data flows and the marked network components associated with each of the paths. 
   
     
     
         7 . The computer-implemented system according to  claim 6 , wherein the operations further comprise collecting the information about the networked computer environment, including network topology of network components and network connections via the network topology graph, network component dependencies, configurations, and attributes, software components, software objects, and data objects. 
     
     
         8 . The computer-implemented system according to  claim 6 , wherein finding paths between the software components, software objects, and data objects via the network topology graph is performed using a depth-first graph search algorithm. 
     
     
         9 . The computer-implemented system according to  claim 6 , wherein finding paths between the software components, software objects, and data objects further comprises;
 analyzing routing and firewall rules of the network as filtered; and   excluding network connections as filtered from mapping of the data flows according to the routing and firewall rules.   
     
     
         10 . The computer-implemented system according to  claim 6 , wherein the operations further comprise:
 defining and organizing data environments, security environments, and security zones to include the marked network components;   defining firewalls for the data environments, security environments, and security zones; and   displaying the networked computer environment including the data environments, security environments, and security zones, filtered network connections, and the marked data flows and the marked network components associated with each of the paths.