Using machine learning based on cross-signal correlation for root cause analysis in a network assurance service

    公开(公告)号:US10785090B2

    公开(公告)日:2020-09-22

    申请号:US15983437

    申请日:2018-05-18

    Abstract: In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

    USING MACHINE LEARNING BASED ON CROSS-SIGNAL CORRELATION FOR ROOT CAUSE ANALYSIS IN A NETWORK ASSURANCE SERVICE

    公开(公告)号:US20190356533A1

    公开(公告)日:2019-11-21

    申请号:US15983437

    申请日:2018-05-18

    Abstract: In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

    Data Anonymization for Distributed Hierarchical Networks

    公开(公告)号:US20170366513A1

    公开(公告)日:2017-12-21

    申请号:US15185380

    申请日:2016-06-17

    Inventor: Vikram Kumaran

    Abstract: Various implementations disclosed herein provide a method for anonymizing data in a distributed hierarchical network. In various implementations, the method includes determining a first set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes that are stored at the first network node and have not been transmitted upstream towards the hub. In various implementations, the method includes receiving, from a second network node, a second set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes at the second network node. In various implementations, the method includes determining whether a sum based on the first and second set of attribute hierarchy counts satisfies an anonymization criterion. In some implementations, the sum indicates a total number of occurrences for a corresponding attribute that are stored at the first and second network nodes and have not been transmitted upstream towards the hub.

    ROOT CAUSE ANALYSIS OF SEASONAL SERVICE LEVEL AGREEMENT (SLA) VIOLATIONS IN SD-WAN TUNNELS

    公开(公告)号:US20200313979A1

    公开(公告)日:2020-10-01

    申请号:US16371556

    申请日:2019-04-01

    Abstract: In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) detects seasonal service level agreement (SLA) violations by one or more tunnels in the SD-WAN using a machine learning-based regression model. The service identifies a root cause of the seasonal SLA violations by determining whether the root cause of the seasonal SLA violations is associated with an internal network connected to the one or more tunnels. The service further identifies the root cause by determining whether the root cause of the seasonal SLA violations is associated with a particular service provider network over which the one or more tunnels traverse by associating the seasonal SLA violations with SLA violations by tunnels in other SD-WANs that also traverse the particular service provider network. The service initiates a corrective measure based on the determined root cause of the seasonal SLA violations by the one or more tunnels.

    INTEGRATING RULE BASED COMPUTER SYSTEMS WITH DISTRIBUTED DATA PROCESSING USING CONTROL AT EDGE AGENTS
    6.
    发明申请
    INTEGRATING RULE BASED COMPUTER SYSTEMS WITH DISTRIBUTED DATA PROCESSING USING CONTROL AT EDGE AGENTS 有权
    使用分布式数据处理集成基于规则的计算机系统

    公开(公告)号:US20160162787A1

    公开(公告)日:2016-06-09

    申请号:US14563111

    申请日:2014-12-08

    CPC classification number: G06N5/025 G06F17/30395 G06F17/30557

    Abstract: In an embodiment, an improved computer-implemented method of efficiently determining actions to perform based on data from a streaming continuous queries in a distributed computer system comprises, at a central control computer, receiving a streaming continuous query and a rule-set; wherein the rule-set comprises decision data representing decisions based on attributes produced by the query, and action data representing end actions based on the decisions, wherein the attributes comprise data processed by one or more networked computers; separating the streaming continuous query into a sub-query executable at one or more edge computers; categorizing end actions from the set based on decisions requiring attributes available from the sub-query into a set of one or more edge expressions that are configured to be evaluated at an edge agent to cause an action; providing the set of edge expressions and the sub-query to at least one edge computer with instructions to process visible attributes on the edge computer and to evaluate the set of one or more edge expressions independently from the central control computer; wherein the method is performed by one or more computing devices.

    Abstract translation: 在一个实施例中,一种改进的计算机实现的方法,其有效地确定基于来自分布式计算机系统中的流式连续查询的数据来执行的动作,包括在中央控制计算机处接收流连续查询和规则集; 其中所述规则集包括基于由所述查询产生的属性来表示决策的决策数据,以及基于所述决定表示结束动作的动作数据,其中所述属性包括由一个或多个联网计算机处理的数据; 将流连续查询分离成一个或多个边缘计算机的子查询可执行文件; 根据需要从子查询可用的属性的决策将结束动作分类成一组一个或多个边缘表达,其被配置为在边缘代理处进行评估以引起动作; 将至少一个边缘计算机的边缘表达式和子查询集合提供给处理边缘计算机上的可见属性的指令,并且独立于中央控制计算机来评估一个或多个边缘表达的集合; 其中所述方法由一个或多个计算设备执行。

    Detecting network entity groups with abnormal time evolving behavior

    公开(公告)号:US10938664B2

    公开(公告)日:2021-03-02

    申请号:US16132933

    申请日:2018-09-17

    Abstract: In one embodiment, a network assurance service that monitors a network calculates network frequency distributions of a performance measurement from the network over a plurality of different time periods. The service calculates entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods. The service determines distance measurements between the network frequency distributions and the entity frequency distributions. The service identifies a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping. The service provides an indication of the identified outlier grouping to a user interface.

    Detecting transient vs. perpetual network behavioral patterns using machine learning

    公开(公告)号:US10547518B2

    公开(公告)日:2020-01-28

    申请号:US15880600

    申请日:2018-01-26

    Abstract: In one embodiment, a network assurance service that monitors a network detects a pattern of network measurements from the network that are associated with a particular network problem. The network assurance service tracks characteristics of the detected pattern over time. The network assurance service uses the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer. The pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern. The network assurance service initiates a change to the network based on an output of the machine learning-based pattern analyzer.

Patent Agency Ranking