Abstract: Network connectivity disruptions impacting users of a network, can be detected based on patterns in user network traffic and network topology data, e.g., by a monitoring server computer. Logged network traffic data can be filtered to identify anomalous data flows. The anomalous data flows can be data flows indicating connection timeouts such as failed Secure Sockets Layer/Transport Layer Security (SSL/TLS) handshakes. Sources and destinations of the anomalous data flows can be mapped to corresponding physical locations using the network topology data, and the anomalous data flows can be grouped by source and destination, in order to determine an impact or scope of a network connectivity disruption. Users of the network can be notified regarding the network connectivity disruption, and optionally, actions can be taken to reduce the impact of the network connectivity disruption.

Abstract: An exposure of a user of a network to an adverse network event can be estimated based on network topology data, network traffic associated with the user, and network performance data. A subgraph of the network topology including candidate paths through the network devices and links of the topology that were traversed by the user's network traffic can be estimated using the network topology data and the network traffic data associated with the user. Using the network performance data, an adverse network event can be mapped on the candidate paths of the subgraph to determine an impact of the adverse network event on the user's network traffic. Upon determining that the adverse network event impacts the user, the user can be notified regarding the adverse network event. Optionally, actions to reduce the impact of the network event on the user can be performed.