Self organizing learning topologies

    公开(公告)号:US10404727B2

    公开(公告)日:2019-09-03

    申请号:US15176678

    申请日:2016-06-08

    Abstract: In one embodiment, a networking device at an edge of a network generates a first set of feature vectors using information regarding one or more characteristics of host devices in the network. The networking device forms the host devices into device clusters dynamically based on the first set of feature vectors. The networking device generates a second set of feature vectors using information regarding traffic associated with the device clusters. The networking device models interactions between the device clusters using a plurality of anomaly detection models that are based on the second set of feature vectors.

    ESTIMATING FEATURE CONFIDENCE FOR ONLINE ANOMALY DETECTION

    公开(公告)号:US20180152466A1

    公开(公告)日:2018-05-31

    申请号:US15364440

    申请日:2016-11-30

    Abstract: In one embodiment, a device in a network obtains characteristic data regarding one or more traffic flows in the network. The device incrementally estimates an amount of noise associated with a machine learning feature using bootstrapping. The machine learning feature is derived from the sampled characteristic data. The device applies a filter to the estimated amount of noise associated with the machine learning feature, to determine a value for the machine learning feature. The device identifies a network anomaly that exists in the network by using the determined value for the machine learning feature as input to a machine learning-based anomaly detector. The device causes performance of an anomaly mitigation action based on the identified network anomaly.

    SPECIALIZING UNSUPERVISED ANOMALY DETECTION SYSTEMS USING GENETIC PROGRAMMING

    公开(公告)号:US20180013776A1

    公开(公告)日:2018-01-11

    申请号:US15205122

    申请日:2016-07-08

    CPC classification number: H04L63/1425 G06N99/005 H04L63/20

    Abstract: In one embodiment, a device in a network receives sets of traffic flow features from an unsupervised machine learning-based anomaly detector. The sets of traffic flow features are associated with anomaly scores determined by the anomaly detector. The device ranks the sets of traffic flow features based in part on their anomaly scores. The device applies a genetic programming approach to the ranked sets of traffic flow features to generate new sets of traffic flow features. The genetic programming approach uses a fitness function that is based in part on the rankings of the sets of traffic flow features. The device specializes the anomaly detector to emphasize a particular type of anomaly using the new sets of traffic flow features.

Patent Agency Ranking