Using a multi-network dataset to overcome anomaly detection cold starts

    公开(公告)号:US10749768B2

    公开(公告)日:2020-08-18

    申请号:US16178679

    申请日:2018-11-02

    Abstract: In one embodiment, a network assurance service receives a first set of telemetry data captured in a first network monitored by the network assurance service. The network assurance service computes, for each of a plurality of other networks monitored by the service, a similarity score between the first set of telemetry data and a set of telemetry data captured in that other network. The service selects a machine learning-based anomaly detector trained using a particular one of the sets of telemetry data captured in one of the plurality of other networks, based on the computed similarity score between the first set of telemetry data and the particular set of telemetry data captured in one of the plurality of other networks. The service uses the selected anomaly detector to assess telemetry data from the first network, until the service has received a threshold amount of telemetry data for the first network.

    KPI TRAJECTORY-DRIVEN OUTLIER DETECTION IN A NETWORK ASSURANCE SERVICE

    公开(公告)号:US20200252310A1

    公开(公告)日:2020-08-06

    申请号:US16263323

    申请日:2019-01-31

    Abstract: In one embodiment, a network assurance service that monitors a network receives a plurality of key performance indicators (KPIs) for a networking device in the network over time. The network assurance service represents relationship changes between the KPIs over time as a set of one or more KPI trajectories. The network assurance service uses a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories. The network assurance service provides an indication of the anomalous behavior of the networking device to a user interface.

    Automated sensor coverage optimization with an actuating walker agent

    公开(公告)号:US10721630B2

    公开(公告)日:2020-07-21

    申请号:US15804064

    申请日:2017-11-06

    Abstract: In one embodiment, a first actuator in a network of sensors and actuators executes a walker agent configured to adjust an actuation setting of the first actuator. The actuation setting controls an area of coverage of the first actuator when actuated. The executing agent on the first actuator receives one or more sensor measurements from one or more of the sensors that are in communication range of the first actuator. The executing agent also controls, based on the received one or more sensor measurements, the area of coverage of the first actuator by adjusting its actuation setting, in an attempt to optimize coverage of the sensors in the network by the areas of coverage of the actuators. The first actuator unloads the executing walker agent after adjusting the actuation setting of the first actuator and propagates the agent to another one of the actuators in the network for execution.

    DISTRIBUTED NETWORK QUERY USING WALKER AGENTS

    公开(公告)号:US20200213179A1

    公开(公告)日:2020-07-02

    申请号:US16814255

    申请日:2020-03-10

    Abstract: In one embodiment, a device in a network receives a query walker agent configured to query information from a distributed set of devices in the network based on a query. The device executes the query walker agent to identify the query. The device updates state information of the executing query walker agent using local information from the device and based on the query. The device unloads the executing query walker agent after updating the state information. The device propagates the query walker agent with the updated state information to one or more of the distributed set of devices in the network, when the updated state information does not fully answer the query.

    Estimating feature confidence for online anomaly detection

    公开(公告)号:US10701092B2

    公开(公告)日:2020-06-30

    申请号:US15364440

    申请日:2016-11-30

    Abstract: In one embodiment, a device in a network obtains characteristic data regarding one or more traffic flows in the network. The device incrementally estimates an amount of noise associated with a machine learning feature using bootstrapping. The machine learning feature is derived from the sampled characteristic data. The device applies a filter to the estimated amount of noise associated with the machine learning feature, to determine a value for the machine learning feature. The device identifies a network anomaly that exists in the network by using the determined value for the machine learning feature as input to a machine learning-based anomaly detector. The device causes performance of an anomaly mitigation action based on the identified network anomaly.

    Eliminating bad rankers and dynamically recruiting rankers in a network assurance system

    公开(公告)号:US10680919B2

    公开(公告)日:2020-06-09

    申请号:US15967668

    申请日:2018-05-01

    Abstract: In one embodiment, a network assurance service that monitors a network detects anomalies in the network by applying one or more machine learning models to telemetry data from the network. The network assurance service ranks feedback from a plurality of anomaly rankers regarding relevancy or criticality of the detected anomalies. The network assurance service clusters the plurality of anomaly rankers into clusters of similar rankers, based on the received ranking feedback. The network assurance service uses the clusters of similar rankers to assign reliability scores to each of the anomaly rankers. The network assurance service selects, based on the reliability scores, a subset of the plurality of anomaly rankers to receive an anomaly detection alert regarding a particular detected anomaly to be ranked. The network assurance service provides the anomaly detection alert to the selected subset of the plurality of anomaly rankers for ranking.

    Packet replication over chains of cascaded resilient link layer segments

    公开(公告)号:US10673734B2

    公开(公告)日:2020-06-02

    申请号:US16126859

    申请日:2018-09-10

    Abstract: In one embodiment, a method comprises generating a switched link layer topology from a source device to a destination device, the switched link layer topology comprising a first sequence of switching devices, a second sequence of switching devices, and one or more bridging links between the first and second sequences of switching devices; generating first and second chains of resilient link layer segments for respective first and second multi-hop link layer connections based on generating a sequence of link layer loops overlying the switched link layer topology, and setting for each of the first and second multi-hop link layer connections a corresponding set of connection blocks in each link layer loop; and causing replication of a data packet across the first and second multi-hop link layer connections, enabling a failure in the switched link layer topology to be bypassed based on removing at least one of the connection blocks.

    DIFFERENTIATING DEVICES WITH SIMILAR NETWORK FOOTPRINTS USING ACTIVE TECHNIQUES

    公开(公告)号:US20200162391A1

    公开(公告)日:2020-05-21

    申请号:US16194449

    申请日:2018-11-19

    Abstract: In one embodiment, a labeling service receives traffic feature data for a cluster of endpoint devices in a network. A device classification service forms the cluster of endpoint devices by applying machine learning-based clustering to the feature data. The labeling service selects a subset of the endpoint devices in the cluster, in an effort to maximize diversity of the traffic feature data of the selected endpoint devices. The labeling service sends a control command into the network, to trigger a traffic behavior by the selected subset. The labeling service receives updated traffic feature data for the selected subset associated with the triggered traffic behavior. The labeling service controls whether a label request is sent to a user interface for labeling of the cluster of endpoint devices with a device type, based on the updated traffic feature data for the subset of endpoint devices in the cluster.

Patent Agency Ranking