Hierarchical models using self organizing learning topologies

    公开(公告)号:US10701095B2

    公开(公告)日:2020-06-30

    申请号:US16190756

    申请日:2018-11-14

    Abstract: In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models.

    SPECIALIZING UNSUPERVISED ANOMALY DETECTION SYSTEMS USING GENETIC PROGRAMMING

    公开(公告)号:US20180013776A1

    公开(公告)日:2018-01-11

    申请号:US15205122

    申请日:2016-07-08

    CPC classification number: H04L63/1425 G06N99/005 H04L63/20

    Abstract: In one embodiment, a device in a network receives sets of traffic flow features from an unsupervised machine learning-based anomaly detector. The sets of traffic flow features are associated with anomaly scores determined by the anomaly detector. The device ranks the sets of traffic flow features based in part on their anomaly scores. The device applies a genetic programming approach to the ranked sets of traffic flow features to generate new sets of traffic flow features. The genetic programming approach uses a fitness function that is based in part on the rankings of the sets of traffic flow features. The device specializes the anomaly detector to emphasize a particular type of anomaly using the new sets of traffic flow features.

    ANOMALY DETECTION USING NETWORK TRAFFIC DATA
    27.
    发明申请
    ANOMALY DETECTION USING NETWORK TRAFFIC DATA 审中-公开
    使用网络流量数据进行异常检测

    公开(公告)号:US20160219070A1

    公开(公告)日:2016-07-28

    申请号:US14989920

    申请日:2016-01-07

    Abstract: In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset.

    Abstract translation: 在一个实施例中,网络中的设备接收网络中的多个应用的​​业务量度。 该设备填充基于机器学习的异常检测器的特征空间。 所述设备识别所述多​​个应用中的特定空间的所述特征空间中的丢失数据集。 该设备调整网络中流量的发送方式,以捕获丢失的数据集。

Patent Agency Ranking