Gregory Mermoud

In various embodiments, a device classification service obtains traffic telemetry data for a plurality of devices in a network. The service applies clustering to the traffic telemetry data, to form device clusters. The service generates a device classification rule based on a particular one of the device clusters. The service receives feedback from a user interface regarding the device classification rule. The service adjusts the device classification rule based on the received feedback.

In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that… Mehr anzeigen

In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores. Weniger anzeigen

In one embodiment, a network assurance service that monitors a plurality of networks subdivides telemetry data regarding devices located in the networks into subsets, wherein each subset is associated with a device type, time period, metric type, and network. The service summarizes each subset by computing distribution percentiles of metric values in the subset. The service identifies an outlier subset by comparing distribution percentiles that summarize the subsets. The service reports insight… Mehr anzeigen

In one embodiment, a network assurance service that monitors a plurality of networks subdivides telemetry data regarding devices located in the networks into subsets, wherein each subset is associated with a device type, time period, metric type, and network. The service summarizes each subset by computing distribution percentiles of metric values in the subset. The service identifies an outlier subset by comparing distribution percentiles that summarize the subsets. The service reports insight data regarding the outlier subset to a user interface. The service adjusts the subsets based in part on feedback regarding the insight data from the user interface. Weniger anzeigen

In one embodiment, a network assurance service receives one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space. The network assurance service applies machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous. The network assurance service identifies, based on the labeled one or more… Mehr anzeigen

In one embodiment, a network assurance service receives one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space. The network assurance service applies machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous. The network assurance service identifies, based on the labeled one or more sets of network characteristics, an anomaly pattern as a collection of unidimensional cutoffs in the feature space. The network assurance service initiates a change to the network based on the identified anomaly pattern. Weniger anzeigen

In one embodiment, a device receives traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types. The device compares the telemetry data from a particular one of the networks to the telemetry data from the other networks to identify one or more traffic characteristics that are missing from the telemetry data for one or more endpoints of the particular network. The device identifies… Mehr anzeigen

In one embodiment, a device receives traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types. The device compares the telemetry data from a particular one of the networks to the telemetry data from the other networks to identify one or more traffic characteristics that are missing from the telemetry data for one or more endpoints of the particular network. The device identifies a networking entity in the particular network that is common to the one or more endpoints for which the one or more characteristics are missing. The device determines a configuration change for the networking entity by comparing a current configuration of the entity to those of one or more entities in the other networks. The device initiates implementation of the determined configuration change for the entity in the particular network. Weniger anzeigen

In one embodiment, a device in a network receives anomaly data regarding an anomaly detected by a machine learning-based anomaly detection mechanism of a first node in the network. The device matches the anomaly data to threat intelligence feed data from one or more threat intelligence services. The device determines whether to provide threat intelligence feedback to the first node based on the matched threat intelligence feed data and one or more policy rules. The device provides threat… Mehr anzeigen

In one embodiment, a device in a network receives anomaly data regarding an anomaly detected by a machine learning-based anomaly detection mechanism of a first node in the network. The device matches the anomaly data to threat intelligence feed data from one or more threat intelligence services. The device determines whether to provide threat intelligence feedback to the first node based on the matched threat intelligence feed data and one or more policy rules. The device provides threat intelligence feedback to the first node regarding the matched threat intelligence feed data, in response to determining that the device should provide threat intelligence feedback to the first node. Weniger anzeigen

In one embodiment, a network assurance service receives a first set of telemetry data captured in a first network monitored by the network assurance service. The network assurance service computes, for each of a plurality of other networks monitored by the service, a similarity score between the first set of telemetry data and a set of telemetry data captured in that other network. The service selects a machine learning-based anomaly detector trained using a particular one of the sets of… Mehr anzeigen

In one embodiment, a network assurance service receives a first set of telemetry data captured in a first network monitored by the network assurance service. The network assurance service computes, for each of a plurality of other networks monitored by the service, a similarity score between the first set of telemetry data and a set of telemetry data captured in that other network. The service selects a machine learning-based anomaly detector trained using a particular one of the sets of telemetry data captured in one of the plurality of other networks, based on the computed similarity score between the first set of telemetry data and the particular set of telemetry data captured in one of the plurality of other networks. The service uses the selected anomaly detector to assess telemetry data from the first network, until the service has received a threshold amount of telemetry data for the first network. Weniger anzeigen

In one embodiment, a network assurance system discretizes parameter values of a plurality of time series of measurements obtained from a monitored network by assigning tags to the parameter values. The network assurance system detects occurrences of a particular type of failure event in the monitored network. The network assurance system identifies a set of the assigned tags that frequently co-occur with the occurrences of the particular type of failure event. The network assurance system… Mehr anzeigen

In one embodiment, a network assurance system discretizes parameter values of a plurality of time series of measurements obtained from a monitored network by assigning tags to the parameter values. The network assurance system detects occurrences of a particular type of failure event in the monitored network. The network assurance system identifies a set of the assigned tags that frequently co-occur with the occurrences of the particular type of failure event. The network assurance system determines, using a Bayesian framework, rankings for the tags in the identified set based on how well each of the tags acts as a predictor of the failure event. The network assurance system initiates performance of a corrective measure for the failure event based in part on the determined rankings for the tags in the identified set. Weniger anzeigen

In one embodiment, a network assurance service applies labels to feature vectors of network characteristics associated with a plurality of wireless access points in the network. An applied label for a feature vector indicates whether the access point associated with the feature vector experienced a threshold number of onboarding delays within a given time window. The service, based on the feature vectors and labels, trains a plurality of machine learning-based classifiers to predict onboarding… Mehr anzeigen

In one embodiment, a network assurance service applies labels to feature vectors of network characteristics associated with a plurality of wireless access points in the network. An applied label for a feature vector indicates whether the access point associated with the feature vector experienced a threshold number of onboarding delays within a given time window. The service, based on the feature vectors and labels, trains a plurality of machine learning-based classifiers to predict onboarding delays, and uses one or more of the trained plurality of classifiers to predict onboarding delays for a particular access point. The service calculates one or more classifier performance metrics for the one or more classifiers based on the predicted onboarding delays for the particular access point. The service selects a particular one of the classifiers to monitor the network characteristics associated with the particular access point, based on the one or more classifier performance metrics.
Weniger anzeigen

In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the… Mehr anzeigen

In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network. Weniger anzeigen

In one embodiment, a device in a network obtains characteristic data regarding one or more traffic flows in the network. The device incrementally estimates an amount of noise associated with a machine learning feature using bootstrapping. The machine learning feature is derived from the sampled characteristic data. The device applies a filter to the estimated amount of noise associated with the machine learning feature, to determine a value for the machine learning feature. The device… Mehr anzeigen

In one embodiment, a device in a network obtains characteristic data regarding one or more traffic flows in the network. The device incrementally estimates an amount of noise associated with a machine learning feature using bootstrapping. The machine learning feature is derived from the sampled characteristic data. The device applies a filter to the estimated amount of noise associated with the machine learning feature, to determine a value for the machine learning feature. The device identifies a network anomaly that exists in the network by using the determined value for the machine learning feature as input to a machine learning-based anomaly detector. The device causes performance of an anomaly mitigation action based on the identified network anomaly. Weniger anzeigen

In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated… Mehr anzeigen

In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models. Weniger anzeigen

In one embodiment, a labeling service receives traffic feature data for a cluster of endpoint devices in a network. A device classification service forms the cluster of endpoint devices by applying machine learning-based clustering to the feature data. The labeling service selects a subset of the endpoint devices in the cluster, in an effort to maximize diversity of the traffic feature data of the selected endpoint devices. The labeling service sends a control command into the network, to… Mehr anzeigen

In one embodiment, a labeling service receives traffic feature data for a cluster of endpoint devices in a network. A device classification service forms the cluster of endpoint devices by applying machine learning-based clustering to the feature data. The labeling service selects a subset of the endpoint devices in the cluster, in an effort to maximize diversity of the traffic feature data of the selected endpoint devices. The labeling service sends a control command into the network, to trigger a traffic behavior by the selected subset. The labeling service receives updated traffic feature data for the selected subset associated with the triggered traffic behavior. The labeling service controls whether a label request is sent to a user interface for labeling of the cluster of endpoint devices with a device type, based on the updated traffic feature data for the subset of endpoint devices in the cluster. Weniger anzeigen

In one embodiment, a network assurance service that monitors a network detects anomalies in the network by applying one or more machine learning models to telemetry data from the network. The network assurance service ranks feedback from a plurality of anomaly rankers regarding relevancy or criticality of the detected anomalies. The network assurance service clusters the plurality of anomaly rankers into clusters of similar rankers, based on the received ranking feedback. The network assurance… Mehr anzeigen

In one embodiment, a network assurance service that monitors a network detects anomalies in the network by applying one or more machine learning models to telemetry data from the network. The network assurance service ranks feedback from a plurality of anomaly rankers regarding relevancy or criticality of the detected anomalies. The network assurance service clusters the plurality of anomaly rankers into clusters of similar rankers, based on the received ranking feedback. The network assurance service uses the clusters of similar rankers to assign reliability scores to each of the anomaly rankers. The network assurance service selects, based on the reliability scores, a subset of the plurality of anomaly rankers to receive an anomaly detection alert regarding a particular detected anomaly to be ranked. The network assurance service provides the anomaly detection alert to the selected subset of the plurality of anomaly rankers for ranking. Weniger anzeigen

In one embodiment, a local service of a network reports configuration information regarding the network to a cloud-based network assurance service. The local service receives a classifier selected by the cloud-based network assurance service based on the configuration information regarding the network. The local service classifies, using the received classifier, telemetry data collected from the network, to select a modeling strategy for the network. The local service installs, based on the… Mehr anzeigen

In one embodiment, a local service of a network reports configuration information regarding the network to a cloud-based network assurance service. The local service receives a classifier selected by the cloud-based network assurance service based on the configuration information regarding the network. The local service classifies, using the received classifier, telemetry data collected from the network, to select a modeling strategy for the network. The local service installs, based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network. Weniger anzeigen

In one embodiment, a device in a network determines cluster assignments that assign traffic data regarding traffic in the network to activity level clusters based on one or more measures of traffic activity in the traffic data. The device uses the cluster assignments to predict seasonal activity for a particular subset of the traffic in the network. The device determines an activity level for new traffic data regarding the particular subset of traffic in the network. The device detects a… Mehr anzeigen

In one embodiment, a device in a network determines cluster assignments that assign traffic data regarding traffic in the network to activity level clusters based on one or more measures of traffic activity in the traffic data. The device uses the cluster assignments to predict seasonal activity for a particular subset of the traffic in the network. The device determines an activity level for new traffic data regarding the particular subset of traffic in the network. The device detects a network anomaly by comparing the activity level for the new traffic data to the predicted seasonal activity. Weniger anzeigen

In one embodiment, a device classification service assigns a set of endpoint devices to a context group. The device classification service forms a context summary feature vector for the context group that summarizes telemetry feature vectors for the endpoint devices assigned to the context group. Each telemetry feature vector is indicative of a plurality of traffic features observed for the endpoint devices. The device classification service normalizes a telemetry feature vector for a… Mehr anzeigen

In one embodiment, a device classification service assigns a set of endpoint devices to a context group. The device classification service forms a context summary feature vector for the context group that summarizes telemetry feature vectors for the endpoint devices assigned to the context group. Each telemetry feature vector is indicative of a plurality of traffic features observed for the endpoint devices. The device classification service normalizes a telemetry feature vector for a particular endpoint device using the context summary feature vector. The device classification service classifies, using the normalized telemetry feature vector for the particular endpoint device as input to a device type classifier, the particular endpoint device as being of a particular device type. Weniger anzeigen

In one embodiment, a device in a network receives a notification of a particular anomaly detected by a distributed learning agent in the network that executes a machine learning-based anomaly detector to analyze traffic in the network. The device computes one or more distance scores between the particular anomaly and one or more previously detected anomalies. The device also computes one or more relevance scores for the one or more previously detected anomalies. The device determines a… Mehr anzeigen

In one embodiment, a device in a network receives a notification of a particular anomaly detected by a distributed learning agent in the network that executes a machine learning-based anomaly detector to analyze traffic in the network. The device computes one or more distance scores between the particular anomaly and one or more previously detected anomalies. The device also computes one or more relevance scores for the one or more previously detected anomalies. The device determines a reporting score for the particular anomaly based on the one or more distance scores and on the one or more relevance scores. The device reports the particular anomaly to a user interface based on the determined reporting score. Weniger anzeigen

In one embodiment, a service identifies a performance issue exhibited by a first device in a first network. The service forms a set of one or more time series of one or more characteristics of the first device associated with the identified performance issue. The service generates a mapping between the set of one or more time series of one or more characteristics of the first device to one or more time series of one or more characteristics of a second device in a second network. The mapping… Mehr anzeigen

In one embodiment, a service identifies a performance issue exhibited by a first device in a first network. The service forms a set of one or more time series of one or more characteristics of the first device associated with the identified performance issue. The service generates a mapping between the set of one or more time series of one or more characteristics of the first device to one or more time series of one or more characteristics of a second device in a second network. The mapping comprises a relevancy score that quantifies a degree of similarity between the characteristics of the first and second devices. The service determines a likelihood of the second device exhibiting the performance issue based on the generated mapping and on the relevancy score. The service provides an indication of the determined likelihood to a user interface associated with the second network. Weniger anzeigen

In one embodiment, a network assurance service that monitors a network detects a behavioral anomaly in the network using an anomaly detector that compares an anomaly detection threshold to a target value calculated based on a first set of one or more measurements from the network. The service uses an explanation model to predict when the anomaly detector will detect anomalies. The explanation model takes as input a second set of one or more measurements from the network that differs from the… Mehr anzeigen

In one embodiment, a network assurance service that monitors a network detects a behavioral anomaly in the network using an anomaly detector that compares an anomaly detection threshold to a target value calculated based on a first set of one or more measurements from the network. The service uses an explanation model to predict when the anomaly detector will detect anomalies. The explanation model takes as input a second set of one or more measurements from the network that differs from the first set. The service determines that the detected anomaly is explainable, based on the explanation model correctly predicting the detection of the anomaly by the anomaly detector. The service provides an anomaly detection alert for the detected anomaly to a user interface, based on the detected anomaly being explainable. The anomaly detection alert indicates at least one measurement from the second set as an explanation for the anomaly. Weniger anzeigen

In one embodiment, a device in a network receives data indicative of a target state for one or more distributed learning agents in the network. The device determines a difference between the target state and state information maintained by the device regarding the one or more distributed learning agents. The device calculates a synchronization penalty score for each of the one or more distributed learning agents. The device selects a particular one of the one or more distributed learning agents… Mehr anzeigen

In one embodiment, a device in a network receives data indicative of a target state for one or more distributed learning agents in the network. The device determines a difference between the target state and state information maintained by the device regarding the one or more distributed learning agents. The device calculates a synchronization penalty score for each of the one or more distributed learning agents. The device selects a particular one of the one or more distributed learning agents with which to synchronize, based on the synchronization penalty score for the selected distributed learning agent and on the determined difference between the target state and the state information regarding the selected distributed learning agent. The device initiates synchronization of the state information maintained by the device regarding the selected distributed learning agent with state information from the selected distributed learning agent. Weniger anzeigen

In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality… Mehr anzeigen

In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node. Weniger anzeigen

In one embodiment, a network assurance service executing in a local network clusters measurements obtained from the local network regarding a plurality of devices in the local network into measurement clusters. The network assurance service computes aggregated metrics for each of the measurement clusters. The network assurance service sends a machine learning model computation request to a remote service outside of the local network that includes the aggregated metrics for each of the… Mehr anzeigen

In one embodiment, a network assurance service executing in a local network clusters measurements obtained from the local network regarding a plurality of devices in the local network into measurement clusters. The network assurance service computes aggregated metrics for each of the measurement clusters. The network assurance service sends a machine learning model computation request to a remote service outside of the local network that includes the aggregated metrics for each of the measurement clusters. The remote service uses the aggregated metrics to train a machine learning-based model to analyze the local network. The network assurance service receives the trained machine learning-based model to analyze performance of the local network. The network assurance service uses the receive machine learning-based model to analyze performance of the local network. Weniger anzeigen

In one embodiment, a first device in a network maintains raw traffic flow information for the network. The first device provides a compressed summary of the raw traffic flow information to a second device in the network. The second device is configured to transform the compressed summary for presentation to a user interface. The first device detects an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector. The first… Mehr anzeigen

In one embodiment, a first device in a network maintains raw traffic flow information for the network. The first device provides a compressed summary of the raw traffic flow information to a second device in the network. The second device is configured to transform the compressed summary for presentation to a user interface. The first device detects an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector. The first device provides at least a portion of the raw traffic flow information related to the anomalous traffic flow to the second device for presentation to the user interface. Weniger anzeigen

In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model… Mehr anzeigen

In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.
Weniger anzeigen

In one embodiment, a device in a network receives feedback regarding an anomaly reporting mechanism used by the device to report network anomalies detected by a plurality of distributed learning agents to a user interface. The device determines an anomaly assessment rate at which a user of the user interface is expected to assess reported anomalies based in part on the feedback. The device receives an anomaly notification regarding a particular anomaly detected by a particular one of the… Mehr anzeigen

In one embodiment, a device in a network receives feedback regarding an anomaly reporting mechanism used by the device to report network anomalies detected by a plurality of distributed learning agents to a user interface. The device determines an anomaly assessment rate at which a user of the user interface is expected to assess reported anomalies based in part on the feedback. The device receives an anomaly notification regarding a particular anomaly detected by a particular one of the distributed learning agents. The device reports, via the anomaly reporting mechanism, the particular anomaly to the user interface based on the determined anomaly assessment rate. Weniger anzeigen

In one embodiment, a device classification service receives a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network. The service classifies the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data. The service instructs the one or more networking devices in the network to reset a finite state machine (FSM) of the… Mehr anzeigen

In one embodiment, a device classification service receives a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network. The service classifies the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data. The service instructs the one or more networking devices in the network to reset a finite state machine (FSM) of the traffic associated with the endpoint device. The device classification service receives a second set of telemetry data regarding traffic associated with the endpoint device and captured after reset of the FSM. The service reclassifies the endpoint device as being of a particular device type, by applying the machine learning-based classifier to the second set of telemetry data. Weniger anzeigen

In one embodiment, a device in a network detects an anomaly in the network using an anomaly detector. The anomaly corresponds to an anomalous behavior exhibited by one or more nodes in the network. The device computes an anomaly score for the anomaly that represents a measure of the anomalous behavior. The device adjusts the anomaly score using a boost score. The boost score is generated by a boosting function that accounts for domain-specific biases of the anomaly detector. The device reports… Mehr anzeigen

In one embodiment, a device in a network detects an anomaly in the network using an anomaly detector. The anomaly corresponds to an anomalous behavior exhibited by one or more nodes in the network. The device computes an anomaly score for the anomaly that represents a measure of the anomalous behavior. The device adjusts the anomaly score using a boost score. The boost score is generated by a boosting function that accounts for domain-specific biases of the anomaly detector. The device reports the anomaly to a supervisory device based on whether the adjusted anomaly score exceeds a reporting threshold. Weniger anzeigen

In one embodiment, one or more reporting nodes are selected to report network metrics in a network. From a monitoring node in the network, a trigger message is sent to the one or more reporting nodes. The trigger message may trigger the one or more reporting nodes to report one or more network metrics local to the respective reporting node. In response to the trigger message, a report of the one or more network metrics is received at the monitoring node from one of the one or more reporting… Mehr anzeigen

In one embodiment, one or more reporting nodes are selected to report network metrics in a network. From a monitoring node in the network, a trigger message is sent to the one or more reporting nodes. The trigger message may trigger the one or more reporting nodes to report one or more network metrics local to the respective reporting node. In response to the trigger message, a report of the one or more network metrics is received at the monitoring node from one of the one or more reporting nodes. Weniger anzeigen

In one embodiment, a device in a network receives traffic records indicative of network traffic between different sets of host address pairs. The device identifies one or more address grouping constraints for the sets of host address pairs. The device determines address groups for the host addresses in the sets of host address pairs based on the one or more address grouping constraints. The device provides an indication of the address groups to an anomaly detector.

In one embodiment, a networking device at an edge of a network generates a first set of feature vectors using information regarding one or more characteristics of host devices in the network. The networking device forms the host devices into device clusters dynamically based on the first set of feature vectors. The networking device generates a second set of feature vectors using information regarding traffic associated with the device clusters. The networking device models interactions between… Mehr anzeigen

In one embodiment, a networking device at an edge of a network generates a first set of feature vectors using information regarding one or more characteristics of host devices in the network. The networking device forms the host devices into device clusters dynamically based on the first set of feature vectors. The networking device generates a second set of feature vectors using information regarding traffic associated with the device clusters. The networking device models interactions between the device clusters using a plurality of anomaly detection models that are based on the second set of feature vectors. Weniger anzeigen

In one embodiment, a device in a network identifies a new interaction between two or more nodes in the network. The device forms a feature vector using contextual information associated with the new interaction between the two or more nodes. The device causes generation of an anomaly detection model for new node interactions using the feature vector. The device uses the anomaly detection model to determine whether a particular node interaction in the network is anomalous.

In one embodiment, a device in a network receives data indicative of traffic characteristics of traffic associated with a particular application. The device identifies one or more paths in the network via which the traffic associated with the particular application was sent, based on the traffic characteristics. The device determines a probing schedule based on the traffic characteristics. The probing schedule simulates the traffic associated with the particular application. The device sends… Mehr anzeigen

In one embodiment, a device in a network receives data indicative of traffic characteristics of traffic associated with a particular application. The device identifies one or more paths in the network via which the traffic associated with the particular application was sent, based on the traffic characteristics. The device determines a probing schedule based on the traffic characteristics. The probing schedule simulates the traffic associated with the particular application. The device sends probes along the one or more identified paths according to the determined probing schedule. Weniger anzeigen

In one embodiment, a device in a network identifies a plurality of traffic records as anomalous. The device matches each of the plurality of traffic records to one or more anomalies using one or more anomaly graphs. A particular anomaly graph represents hosts in the network as vertices in the graph and communications between hosts as edges in the graph. The device applies one or more ordering rules to the traffic records, to uniquely associate each traffic record to an anomaly in the one or… Mehr anzeigen

In one embodiment, a device in a network identifies a plurality of traffic records as anomalous. The device matches each of the plurality of traffic records to one or more anomalies using one or more anomaly graphs. A particular anomaly graph represents hosts in the network as vertices in the graph and communications between hosts as edges in the graph. The device applies one or more ordering rules to the traffic records, to uniquely associate each traffic record to an anomaly in the one or more anomalies. The device sends an anomaly notification for a particular anomaly that is based on the traffic records associated with the particular anomaly. Weniger anzeigen

In one embodiment, a node in a network reports, to a supervisory service, histograms of application-specific throughput metrics measured from the network. The node receives, from the supervisory service, a merged histogram of application-specific throughput metrics. The supervisory service generated the merged histogram based on a plurality of histograms reported to the supervisory service by a plurality of nodes. The node performs, using the merged histogram, application throughput anomaly… Mehr anzeigen

In one embodiment, a node in a network reports, to a supervisory service, histograms of application-specific throughput metrics measured from the network. The node receives, from the supervisory service, a merged histogram of application-specific throughput metrics. The supervisory service generated the merged histogram based on a plurality of histograms reported to the supervisory service by a plurality of nodes. The node performs, using the merged histogram, application throughput anomaly detection on traffic in the network. The node causes performance of a mitigation action in the network when an application throughput anomaly is detected. The node adjusts, based on a control command sent by the supervisory service, a histogram reporting strategy used by the node to report the histograms of application-specific throughput metrics to the supervisory service. Weniger anzeigen

In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the… Mehr anzeigen

In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network. Weniger anzeigen

In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset.

A device in a network receives fingerprints of two or more network anomalies detected in the network by different anomaly detectors. Each fingerprint comprises a hash of tags that describe a detected anomaly. The device associates the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected. The device compares the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a… Mehr anzeigen

A device in a network receives fingerprints of two or more network anomalies detected in the network by different anomaly detectors. Each fingerprint comprises a hash of tags that describe a detected anomaly. The device associates the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected. The device compares the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event. The device generates a notification regarding the singular anomaly event. The notification includes those of the fingerprints that are associated with the singular anomaly event. Weniger anzeigen

In one embodiment, a predictive model is constructed by mapping multiple network characteristics to multiple network performance metrics. Then, a network performance metric pertaining to a node in a network is predicted based on the constructed predictive model and one or more network characteristics relevant to the node. Also, a local parameter of the node is optimized based on the predicted network performance metric.

In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between… Mehr anzeigen

In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network. The device deploys the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network. Weniger anzeigen

In one embodiment, a networking device in a network causes formation of device clusters of devices in the network. The devices in a particular cluster exhibit similar characteristics. The networking device receives feedback from a device identity service regarding the device clusters. The feedback is based in part on the device identity service probing the devices. The networking device adjusts the device clusters based on the feedback from the device identity service. The networking device… Mehr anzeigen

In one embodiment, a networking device in a network causes formation of device clusters of devices in the network. The devices in a particular cluster exhibit similar characteristics. The networking device receives feedback from a device identity service regarding the device clusters. The feedback is based in part on the device identity service probing the devices. The networking device adjusts the device clusters based on the feedback from the device identity service. The networking device performs anomaly detection in the network using the adjusted device clusters. Weniger anzeigen

In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis… Mehr anzeigen

In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors. The device provides a label for the particular state vector to a user interface. The label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors. Weniger anzeigen

In one embodiment, a device in a network loads an anomaly detection model for warm-start. The device filters input data for the model during a warm-start grace period after warm-start of the anomaly detection model. The model is not updated during the warm-start grace period based on the filtering. The device determines an end to the warm-start grace period. The device updates the anomaly detection model using unfiltered input data for the anomaly detection model after the determined end to the… Mehr anzeigen

In one embodiment, a device in a network loads an anomaly detection model for warm-start. The device filters input data for the model during a warm-start grace period after warm-start of the anomaly detection model. The model is not updated during the warm-start grace period based on the filtering. The device determines an end to the warm-start grace period. The device updates the anomaly detection model using unfiltered input data for the anomaly detection model after the determined end to the warm-start grace period. Weniger anzeigen

In one embodiment, a supervisory device in a network receives traffic data from a security device that uses traffic signatures to assess traffic in the network. The supervisory device receives traffic data from one or more distributed learning agents that use machine learning-based anomaly detection to assess traffic in the network. The supervisory device trains a traffic classifier using the received traffic data from the security device and from the one or more distributed learning agents… Mehr anzeigen

In one embodiment, a supervisory device in a network receives traffic data from a security device that uses traffic signatures to assess traffic in the network. The supervisory device receives traffic data from one or more distributed learning agents that use machine learning-based anomaly detection to assess traffic in the network. The supervisory device trains a traffic classifier using the received traffic data from the security device and from the one or more distributed learning agents. The supervisory device deploys the traffic classifier to a selected one of the one or more distributed learning agents. Weniger anzeigen

In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.

In one embodiment, network information associated with a plurality of nodes in a network is received at a device in a network. From the plurality of nodes, a node is selected based on a determination that the selected node is an outlier among the plurality of nodes according to the received network information. Then, a probe is sent to the selected node, and in response to the probe, a performance metric is received from the selected node at the device.

In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated… Mehr anzeigen

In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models. Weniger anzeigen

Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the… Mehr anzeigen

Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the traffic flow through the network. Backup parent selection for a node in the network is performed based on previous performance of backup parents for the node. Weniger anzeigen

In one embodiment, a learning machine may be used to select observer nodes in a LLN such that the liveness of one or more nodes of interest may be monitored indirectly. In particular, a management device may receive network data on one or more network traffic parameters of a computer network. The management device may then determine, based on the network data, a candidate list of potential observer nodes to monitor activity or inactivity of one or more subject nodes. The management device may… Mehr anzeigen

In one embodiment, a learning machine may be used to select observer nodes in a LLN such that the liveness of one or more nodes of interest may be monitored indirectly. In particular, a management device may receive network data on one or more network traffic parameters of a computer network. The management device may then determine, based on the network data, a candidate list of potential observer nodes to monitor activity or inactivity of one or more subject nodes. The management device may then dynamically select, using a machine learning model, a set of optimized observer nodes from the candidate list of potential observer nodes. Weniger anzeigen

In one embodiment, a device in a network analyzes local network data regarding a portion of the network that is local to the device using a first anomaly detection model. The device analyzes the local network data using a second anomaly detection model that was trained in part using remote network data regarding a portion of the network that is remote to the device. The device compares outputs of the first and second anomaly detection models. The device identifies the local network data as… Mehr anzeigen

In one embodiment, a device in a network analyzes local network data regarding a portion of the network that is local to the device using a first anomaly detection model. The device analyzes the local network data using a second anomaly detection model that was trained in part using remote network data regarding a portion of the network that is remote to the device. The device compares outputs of the first and second anomaly detection models. The device identifies the local network data as peculiar, in response to the first anomaly detection model determining the local network data to be normal and the second anomaly detection model determining the local network data to be anomalous. Weniger anzeigen

In one embodiment, a device in a network receives an output of an anomaly detection model. The device receives state information surrounding the output of the anomaly detection model. The device determines whether the state information supports the output of the anomaly detection model. The device causes the anomaly detection model to be adjusted based on a determination that the state information does not support the output of the anomaly detection model.

In one embodiment, a network device receives metrics regarding a path in the network. A predictive model is generated using the received metrics and is operable to predict available bandwidth along the path for a particular type of traffic. A determination is made as to whether a confidence score for the predictive model is below a confidence threshold associated with the particular type of traffic. The device obtains additional data regarding the path based on a determination that the… Mehr anzeigen

In one embodiment, a network device receives metrics regarding a path in the network. A predictive model is generated using the received metrics and is operable to predict available bandwidth along the path for a particular type of traffic. A determination is made as to whether a confidence score for the predictive model is below a confidence threshold associated with the particular type of traffic. The device obtains additional data regarding the path based on a determination that the confidence score is below the confidence threshold. The predictive model is updated using the additional data regarding the path. Weniger anzeigen

In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the… Mehr anzeigen

In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models. Weniger anzeigen

In one embodiment, a device in a network receives data indicative of traffic characteristics of traffic associated with a particular application. The device identifies one or more paths in the network via which the traffic associated with the particular application was sent, based on the traffic characteristics. The device determines a probing schedule based on the traffic characteristics. The probing schedule simulates the traffic associated with the particular application. The device sends… Mehr anzeigen

In one embodiment, a device in a network receives data indicative of traffic characteristics of traffic associated with a particular application. The device identifies one or more paths in the network via which the traffic associated with the particular application was sent, based on the traffic characteristics. The device determines a probing schedule based on the traffic characteristics. The probing schedule simulates the traffic associated with the particular application. The device sends probes along the one or more identified paths according to the determined probing schedule. Weniger anzeigen

In one embodiment, techniques are shown and described relating to dynamically adjusting a set of monitored network properties using distributed learning machine feedback. In particular, in one embodiment, a learning machine (or distributed learning machines) determines a plurality of monitored network properties in a computer network. From this, a subset of relevant network properties of the plurality of network properties may be determined, such that a corresponding subset of irrelevant… Mehr anzeigen

In one embodiment, techniques are shown and described relating to dynamically adjusting a set of monitored network properties using distributed learning machine feedback. In particular, in one embodiment, a learning machine (or distributed learning machines) determines a plurality of monitored network properties in a computer network. From this, a subset of relevant network properties of the plurality of network properties may be determined, such that a corresponding subset of irrelevant network properties based on the subset of relevant network properties may also be determined. Accordingly, the computer network may be informed of the irrelevant network properties to reduce a rate of monitoring the irrelevant network properties. Weniger anzeigen

In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.

In one embodiment, a management system determines respective capability information of machine learning systems, the capability information including at least an action the respective machine learning system is configured to perform. The management system receives, for each of the machine learning systems, respective performance scoring information associated with the respective action, and computes a degree of freedom for each machine learning system to perform the respective action based on… Mehr anzeigen

In one embodiment, a management system determines respective capability information of machine learning systems, the capability information including at least an action the respective machine learning system is configured to perform. The management system receives, for each of the machine learning systems, respective performance scoring information associated with the respective action, and computes a degree of freedom for each machine learning system to perform the respective action based on the performance scoring information. Accordingly, the management system then specifies the respective degree of freedom to the machine learning systems. In one embodiment, the management system comprises a management device that computes a respective trust level for the machine learning systems based on receiving the respective performance scoring feedback, and a policy engine that computes the degree of freedom based on receiving the trust level. In further embodiments, the machine learning system performs the action based on the degree of freedom. Weniger anzeigen

In one embodiment, a device in a network monitors performance data for a first predictive model. The first predictive model is used to make proactive decisions in the network. The device maintains a supervisory model based on the monitored performance data for the first predictive model. The device identifies a time period during which the supervisory model predicts that the first predictive model will perform poorly. The device causes a switchover from the first predictive model to a second… Mehr anzeigen

In one embodiment, a device in a network monitors performance data for a first predictive model. The first predictive model is used to make proactive decisions in the network. The device maintains a supervisory model based on the monitored performance data for the first predictive model. The device identifies a time period during which the supervisory model predicts that the first predictive model will perform poorly. The device causes a switchover from the first predictive model to a second predictive model at a point in time associated with the time period, in response to identifying the time period. Weniger anzeigen

In one embodiment, a device in a network detects an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model. The device receives feedback regarding the detected anomaly. The device determines that the anomaly was a true positive based on the received feedback. The device excludes the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true… Mehr anzeigen

In one embodiment, a device in a network detects an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model. The device receives feedback regarding the detected anomaly. The device determines that the anomaly was a true positive based on the received feedback. The device excludes the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive. Weniger anzeigen

In one embodiment, network metrics are collected and analyzed in a network having nodes interconnected by communication links. Then, it is predicted whether a network element failure is relatively likely to occur based on the collected and analyzed network metrics. In response to predicting that a network element failure is relatively likely to occur, traffic in the network is rerouted in order to avoid the network element failure before it is likely to occur.

In one embodiment, a learning data processor determines a plurality of machine learning features in a computer network to collect. Upon receiving data corresponding to the plurality of features, the learning data processor may aggregate the data, and pushes the aggregated data for select features to interested learning machines associated with the computer network.

In one embodiment, a central device receives a routing strategy instruction that specifies a predictability threshold for communication delays in the network. The device estimates communication delays for a plurality of paths in the network and determines predictability measurements for the estimated delays. The device also selects, from among the plurality of paths, a particular path that has a predictability measurement that satisfies the predictability threshold and has a minimal estimated… Mehr anzeigen

In one embodiment, a central device receives a routing strategy instruction that specifies a predictability threshold for communication delays in the network. The device estimates communication delays for a plurality of paths in the network and determines predictability measurements for the estimated delays. The device also selects, from among the plurality of paths, a particular path that has a predictability measurement that satisfies the predictability threshold and has a minimal estimated delay. The central device further installs the particular path at one or more other devices in the network. Weniger anzeigen

In one embodiment, network information associated with a plurality of nodes in a network is received at a device in a network. From the plurality of nodes, a node is selected based on a determination that the selected node is an outlier among the plurality of nodes according to the received network information. Then, a probe is sent to the selected node, and in response to the probe, a performance metric is received from the selected node at the device.

In one embodiment, liveness reporting is performed using a distributed approach. The embodiments include a management node that is configured to receive a message containing an indication of activity or inactivity of one or more subject nodes, and determine which of the one or more subject nodes are active based on the received message. The indication is derived from one or more observer nodes observing network traffic of the one or more subject nodes. The embodiments further include one or… Mehr anzeigen

In one embodiment, liveness reporting is performed using a distributed approach. The embodiments include a management node that is configured to receive a message containing an indication of activity or inactivity of one or more subject nodes, and determine which of the one or more subject nodes are active based on the received message. The indication is derived from one or more observer nodes observing network traffic of the one or more subject nodes. The embodiments further include one or more observer nodes configured to observe network traffic of the one or more subject nodes in the network, generate the message containing the indication of activity or inactivity of the one or more subject nodes, and transmit the message to the management node. Weniger anzeigen

In one embodiment, a state tracking engine (STE) defines one or more classes of elements that can be tracked in a network. A set of elements to track is determined from the one or more classes, and the set of elements is tracked in the network. Access to the tracked set of elements then provided via one or more corresponding application programming interfaces (APIs). In another embodiment, a metric computation engine (MCE) defines one or more network metrics to be tracked in the network. One or… Mehr anzeigen

In one embodiment, a state tracking engine (STE) defines one or more classes of elements that can be tracked in a network. A set of elements to track is determined from the one or more classes, and the set of elements is tracked in the network. Access to the tracked set of elements then provided via one or more corresponding application programming interfaces (APIs). In another embodiment, a metric computation engine (MCE) defines one or more network metrics to be tracked in the network. One or more tracked elements are received from the STE. The one or more network metrics are tracked in the network based on the received one or more tracked elements. Access to the tracked network metrics is then provided via one or more corresponding APIs. Weniger anzeigen

In one embodiment, network data is received at a Learning Machine (LM) in a network. It is determined whether the LM recognizes the received network data based on information available to the LM. When the LM fails to recognize the received network data: a connection to a central management node is established, a request is sent for information relating to the unrecognized network data to the central management node, and information is received from the central management node in response to the… Mehr anzeigen

In one embodiment, network data is received at a Learning Machine (LM) in a network. It is determined whether the LM recognizes the received network data based on information available to the LM. When the LM fails to recognize the received network data: a connection to a central management node is established, a request is sent for information relating to the unrecognized network data to the central management node, and information is received from the central management node in response to the request. The received information assists the LM in recognizing the unrecognized network data. Weniger anzeigen

In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties x.sub.i and network performance metrics M.sub.i from a network management server (NMS), and then intercepts x.sub.i and M.sub.i transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on x.sub.i… Mehr anzeigen

In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties x.sub.i and network performance metrics M.sub.i from a network management server (NMS), and then intercepts x.sub.i and M.sub.i transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on x.sub.i and M.sub.i, and can detect one or more anomalies in the intercepted x.sub.i and M.sub.i based on the regression function F. In another embodiment, the NMS, which instructed the border router, receives the detected anomalies from the border router. Weniger anzeigen

In one embodiment, techniques are shown and described relating to a point-to-multipoint communication infrastructure for expert-based knowledge feed-back using learning machines. A learning machine may communicate an expert discovery request into a network to discover one or more experts, and then receive from the one or more experts, one or more expert discovery responses. Based on the one or more received expert discovery responses, the learning machine may then build a dynamic multicast tree… Mehr anzeigen

In one embodiment, techniques are shown and described relating to a point-to-multipoint communication infrastructure for expert-based knowledge feed-back using learning machines. A learning machine may communicate an expert discovery request into a network to discover one or more experts, and then receive from the one or more experts, one or more expert discovery responses. Based on the one or more received expert discovery responses, the learning machine may then build a dynamic multicast tree of experts to assist the learning machine in a computer network. Weniger anzeigen

In one embodiment, a triggered reboot of a field area router (FAR) of a computer network is initiated, and gathered states of the FAR are saved. The nodes in the computer network are informed of the triggered reboot, and then feedback may be collected from the nodes in response to the triggered reboot. As such, it can be determined whether to complete the triggered reboot based on the feedback, and the FAR is rebooted in response to determining to complete the triggered reboot. In another… Mehr anzeigen

In one embodiment, a triggered reboot of a field area router (FAR) of a computer network is initiated, and gathered states of the FAR are saved. The nodes in the computer network are informed of the triggered reboot, and then feedback may be collected from the nodes in response to the triggered reboot. As such, it can be determined whether to complete the triggered reboot based on the feedback, and the FAR is rebooted in response to determining to complete the triggered reboot. In another embodiment, a node receives information about the initiated triggered reboot of the FAR, and determines whether it has critical traffic. If not, the node buffers non-critical traffic and indicates positive feedback in response to the triggered reboot, but if so, then the node continues to process the critical traffic and indicates negative feedback in response to the triggered reboot. Weniger anzeigen

In one embodiment, techniques are shown and described relating to a mixed centralized/distributed algorithm for risk mitigation in sparsely connected networks. In particular, in one embodiment, a management node determines one or more weak point nodes in a shared-media communication network, where a weak point node is a node traversed by a relatively high amount of traffic as compared to other nodes in the network. In response to determining that a portion of the traffic can be routed over an… Mehr anzeigen

In one embodiment, techniques are shown and described relating to a mixed centralized/distributed algorithm for risk mitigation in sparsely connected networks. In particular, in one embodiment, a management node determines one or more weak point nodes in a shared-media communication network, where a weak point node is a node traversed by a relatively high amount of traffic as compared to other nodes in the network. In response to determining that a portion of the traffic can be routed over an alternate acceptable node, the management node instructs the portion of traffic to reroute over the alternate acceptable node. Weniger anzeigen

In one embodiment, techniques are shown and described relating to dynamically determining node locations to apply learning machine based network performance improvement. In particular, a degree of significance of nodes in a network, respectively, is calculated based on one or more significance factors. One or more significant nodes are then determined based on the calculated degree of significance. Additionally, a nodal region in the network of deteriorated network health is determined, and the… Mehr anzeigen

In one embodiment, techniques are shown and described relating to dynamically determining node locations to apply learning machine based network performance improvement. In particular, a degree of significance of nodes in a network, respectively, is calculated based on one or more significance factors. One or more significant nodes are then determined based on the calculated degree of significance. Additionally, a nodal region in the network of deteriorated network health is determined, and the nodal region of deteriorated network health is correlated with a significant node of the one or more significant nodes. Weniger anzeigen

In one embodiment, techniques are shown and described relating to learning machine based computation of network join times. In particular, in one embodiment, a device computes a join time of the device to join a computer network. During joining, the device sends a configuration request to a server, and receives instructions whether to provide the join time. The device may then provide the join time to a collector in response to instructions to provide the join time. In another embodiment, a… Mehr anzeigen

In one embodiment, techniques are shown and described relating to learning machine based computation of network join times. In particular, in one embodiment, a device computes a join time of the device to join a computer network. During joining, the device sends a configuration request to a server, and receives instructions whether to provide the join time. The device may then provide the join time to a collector in response to instructions to provide the join time. In another embodiment, a collector receives a plurality of join times from a respective plurality of nodes having one or more associated node properties. The collector may then estimate a mapping between the join times and the node properties and determines a confidence interval of the mapping. Accordingly, the collector may then determine a rate at which nodes having particular node properties report their join times based on the confidence interval. Weniger anzeigen

In one embodiment, a device in a network identifies a set of one or more destination addresses for which traffic shaping is to be performed by controlling the data rate at which traffic is sent to the one or more destination addresses. The device sends the traffic to one of the destination addresses along a communication path in the network and at a particular data rate. The device identifies a change in a performance characteristic for the communication path. The device adjusts the data rate… Mehr anzeigen

In one embodiment, a device in a network identifies a set of one or more destination addresses for which traffic shaping is to be performed by controlling the data rate at which traffic is sent to the one or more destination addresses. The device sends the traffic to one of the destination addresses along a communication path in the network and at a particular data rate. The device identifies a change in a performance characteristic for the communication path. The device adjusts the data rate at which the traffic is sent along the communication path, in response to identifying the change in the performance characteristic for the communication path. Weniger anzeigen

n one embodiment, a machine learning model for predicting one or more metrics is run in a network which includes a centralized controller device interconnected with a plurality of edge devices. A batch version of the machine learning model that operates in batch mode is hosted at the centralized controller device. Then, an incremental version of the machine learning model that operates in incremental mode is pushed to an edge device of the plurality of edge devices, such that the incremental… Mehr anzeigen

n one embodiment, a machine learning model for predicting one or more metrics is run in a network which includes a centralized controller device interconnected with a plurality of edge devices. A batch version of the machine learning model that operates in batch mode is hosted at the centralized controller device. Then, an incremental version of the machine learning model that operates in incremental mode is pushed to an edge device of the plurality of edge devices, such that the incremental version of the machine learning model is hosted at the edge device. As a result, the batch version and the incremental version of the machine learning model run in parallel with one another. Weniger anzeigen

In one embodiment, a message is received at a caching node in a network including an indication of the message's urgency. The message is transmitted to child nodes of the caching node, and upon transmitting the message, a retransmission timer is initiated when the message is urgent, based on the indication of the message's urgency. Then, one or more acknowledgements of receipt of the transmitted message are received from one or more of the child nodes, respectively. Upon expiration of the… Mehr anzeigen

In one embodiment, a message is received at a caching node in a network including an indication of the message's urgency. The message is transmitted to child nodes of the caching node, and upon transmitting the message, a retransmission timer is initiated when the message is urgent, based on the indication of the message's urgency. Then, one or more acknowledgements of receipt of the transmitted message are received from one or more of the child nodes, respectively. Upon expiration of the retransmission timer, when it is determined that one or more of the child nodes did not receive the transmitted message based on the received acknowledgements, the message is retransmitted to the child nodes. Weniger anzeigen

In one embodiment, nodes are polled in a network for Quality of Service (QoS) measurements, and a QoS anomaly that affects a plurality of potentially faulty nodes is detected based on the QoS measurements. A path, which traverses the plurality of potentially faulty nodes, is then computed from a first endpoint to a second endpoint. Also, a median node that is located at a point along the path between the first endpoint and the second endpoint is computed. Time-stamped packets are received from… Mehr anzeigen

In one embodiment, nodes are polled in a network for Quality of Service (QoS) measurements, and a QoS anomaly that affects a plurality of potentially faulty nodes is detected based on the QoS measurements. A path, which traverses the plurality of potentially faulty nodes, is then computed from a first endpoint to a second endpoint. Also, a median node that is located at a point along the path between the first endpoint and the second endpoint is computed. Time-stamped packets are received from the median node, and the first endpoint and the second endpoint of the path are updated based on the received time-stamped packets, such that an amount of potentially faulty nodes is reduced. Then, the faulty node is identified from a reduced amount of potentially faulty nodes. Weniger anzeigen

In one embodiment, a method is disclosed in which a device receives delay information for a communication segment in a network. The device determines a predictability measurement for delays along the segment using the received delay information. The predictability measurement is advertised to one or more devices in the network and used as a routing constraint to select a routing path in the network.

In one embodiment, a device determines a topological profile of individual nodes in a shared-media communication network, and also determines a respective likelihood of the nodes in the network to become a root of a floating topology based on the topological profiles. Accordingly, the device may provide instructions to particular nodes in the network based on the respective likelihoods.

In one embodiment, a device determines a topological profile of individual nodes in a shared-media communication network, and also determines a respective likelihood of the nodes in the network to become a root of a floating topology based on the topological profiles. Accordingly, the device may provide instructions to particular nodes in the network based on the respective likelihoods.

In one embodiment, periodic round-trip probes are executed in a network, whereby a packet is transmitted along a particular communication path from a source to a destination and back to the source. Statistical information relating to the round-trip probes is gathered, and a transmission delay of the round-trip probes is calculated based on the gathered statistical information. Also, an end-to-end transmission delay along an arbitrary communication path in the network is estimated based on the… Mehr anzeigen

In one embodiment, periodic round-trip probes are executed in a network, whereby a packet is transmitted along a particular communication path from a source to a destination and back to the source. Statistical information relating to the round-trip probes is gathered, and a transmission delay of the round-trip probes is calculated based on the gathered statistical information. Also, an end-to-end transmission delay along an arbitrary communication path in the network is estimated based on the calculated transmission delay of the round-trip probes. Weniger anzeigen

n one embodiment, information relating to network metrics in a computer network is collected. A packet delay for a packet to be transmitted along a particular communication path is predicted based on the network metrics. Then, an optimal packet size for optimizing a transmission experience of the packet to be transmitted along the particular communication path is calculated based on the predicted packet delay. Also, a size of the packet to be transmitted along the particular communication path… Mehr anzeigen

n one embodiment, information relating to network metrics in a computer network is collected. A packet delay for a packet to be transmitted along a particular communication path is predicted based on the network metrics. Then, an optimal packet size for optimizing a transmission experience of the packet to be transmitted along the particular communication path is calculated based on the predicted packet delay. Also, a size of the packet to be transmitted along the particular communication path is dynamically adjusted based on the calculated optimal packet size.
Inventors: Weniger anzeigen

In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined. Important nodes in the network which are of relative importance are determined based on their location in the determined routing topology. Also, one or more request messages are sent causing the important nodes to gather local network metrics. Then, in response to the one or more request messages, one or more response messages including the network metrics gathered by each… Mehr anzeigen

In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined. Important nodes in the network which are of relative importance are determined based on their location in the determined routing topology. Also, one or more request messages are sent causing the important nodes to gather local network metrics. Then, in response to the one or more request messages, one or more response messages including the network metrics gathered by each important node are received. Weniger anzeigen

In one embodiment, a request is received from a requesting node in a network to assist in distributing a task of the requesting node. Upon receiving the message, a capability to perform the task of one or more helping nodes in the network is evaluated, and a helping node of the one or more helping nodes is selected to perform the task based on the evaluated capability of the selected helping node. The distribution of the task is then authorized from the requesting node to the selected helping… Mehr anzeigen

In one embodiment, a request is received from a requesting node in a network to assist in distributing a task of the requesting node. Upon receiving the message, a capability to perform the task of one or more helping nodes in the network is evaluated, and a helping node of the one or more helping nodes is selected to perform the task based on the evaluated capability of the selected helping node. The distribution of the task is then authorized from the requesting node to the selected helping node. Weniger anzeigen

In one embodiment, variables maintained by each of a plurality of Learning Machines (LMs) are determined. The LMs are hosted on a plurality of Field Area Routers (FARs) in a network, and the variables are sharable between the FARs. A plurality of correlation values defining a correlation between the variables is calculated. Then, a cluster of FARs is computed based on the plurality of correlation values, such that the clustered FARs are associated with correlated variables, and the cluster… Mehr anzeigen

In one embodiment, variables maintained by each of a plurality of Learning Machines (LMs) are determined. The LMs are hosted on a plurality of Field Area Routers (FARs) in a network, and the variables are sharable between the FARs. A plurality of correlation values defining a correlation between the variables is calculated. Then, a cluster of FARs is computed based on the plurality of correlation values, such that the clustered FARs are associated with correlated variables, and the cluster allows the clustered FARs to share their respective variables. Weniger anzeigen

In one embodiment, a device (e.g., learning machine) determines a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event. As such, the device may elect one or more FSG owner nodes as a subset of the FSG nodes, and instructs the FSG group such that only FSG owner nodes send an alarm upon event detection.

In one embodiment, a message is received at a node in a network indicating that the node is classified as a critical node, and requesting the node to proactively time-stamp data packets. Data packets are received from one or more child nodes of the node, and the node selects a data packet of the received data packets to time-stamp. Then, the node proactively inserts a time-stamp in the selected data packet. The time-stamped data packet is sent toward a central management node.

In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined, and activity in the network is monitored to determine a normal behavior of the communication links. Weak communication links in the network that deviate from the determined normal behavior are detected, and it is then determined whether the weak communication links are spatially correlated based on the determined topology of the network. In response to the weak communication… Mehr anzeigen

In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined, and activity in the network is monitored to determine a normal behavior of the communication links. Weak communication links in the network that deviate from the determined normal behavior are detected, and it is then determined whether the weak communication links are spatially correlated based on the determined topology of the network. In response to the weak communication links being spatially correlated, a region of the network affected by the weak communication links is identified as a dark zone that is to be avoided when routing data packets in the network. Weniger anzeigen

In one embodiment, a node receives a request to initiate a shadow joining operation to shadow join a field area router (FAR) of a computer network, and preserves its data structures and soft states. The shadow joining operation may then be initiated to shadow join the FAR, wherein shadow joining comprises preforming join operations without leaving a currently joined-FAR, and the node measures one or more joining metrics of the shadow joining operation, and reports them accordingly. In another… Mehr anzeigen

In one embodiment, a node receives a request to initiate a shadow joining operation to shadow join a field area router (FAR) of a computer network, and preserves its data structures and soft states. The shadow joining operation may then be initiated to shadow join the FAR, wherein shadow joining comprises preforming join operations without leaving a currently joined-FAR, and the node measures one or more joining metrics of the shadow joining operation, and reports them accordingly. In another embodiment, a FAR (or other management device) determines a set of nodes to participate in a shadow joining operation, and informs the set of nodes of the shadow joining operation to shadow join the FAR. The device (e.g., FAR) participates in the shadow joining operation, and receives reports of one or more joining metrics of the shadow joining operation measured by the set of nodes. Weniger anzeigen

In one embodiment, a targeted node in a computer network receives a probe generation request (PGR), and in response, generates a link-local multicast PGR (PGR-Local) carrying instructions for generating probes based on the PGR. The targeted node then transmits the PGR-Local to neighbors of the targeted node to cause one or more of the neighbors to generate and transmit probes to a collection device in the computer network according to the PGR-Local instructions. In another embodiment, a… Mehr anzeigen

In one embodiment, a targeted node in a computer network receives a probe generation request (PGR), and in response, generates a link-local multicast PGR (PGR-Local) carrying instructions for generating probes based on the PGR. The targeted node then transmits the PGR-Local to neighbors of the targeted node to cause one or more of the neighbors to generate and transmit probes to a collection device in the computer network according to the PGR-Local instructions. In another embodiment, a particular node in a computer network receives a link-local multicast probe generation request (PGR-Local) from a targeted node in the computer network, the targeted node having received the PGR-Local from a remote device, and determines how to generate probes based on instructions carried within the PGR-Local before sending one or more probes to a collection device in the computer network according to the PGR-Local instructions. Weniger anzeigen

In one embodiment, a packet to be transmitted along a communication path in a network from a source to a destination is determined, the communication path having one or more hops between the source and the destination. An instruction is sent to one or more tracking nodes along the communication path to track a number of local retransmissions required to successfully transmit the packet from each tracking node to a respective next-hop destination. Then, reports indicating the number of local… Mehr anzeigen

In one embodiment, a packet to be transmitted along a communication path in a network from a source to a destination is determined, the communication path having one or more hops between the source and the destination. An instruction is sent to one or more tracking nodes along the communication path to track a number of local retransmissions required to successfully transmit the packet from each tracking node to a respective next-hop destination. Then, reports indicating the number of local retransmissions are received from the one or more tracking nodes. Weniger anzeigen

Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the… Mehr anzeigen

Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the traffic flow through the network. Backup parent selection for a node in the network is performed based on previous performance of backup parents for the node. Weniger anzeigen

In one embodiment, a plurality of communication paths in a second direction in a communication network is determined, based on reversing communication paths established in a first direction in the communication network. Then, a path quality of the communication paths in the second direction is monitored. Based on the monitored path quality, it is then determined whether the communication paths in the second direction satisfy a communication requirement. Finally, a particular communication path… Mehr anzeigen

In one embodiment, a plurality of communication paths in a second direction in a communication network is determined, based on reversing communication paths established in a first direction in the communication network. Then, a path quality of the communication paths in the second direction is monitored. Based on the monitored path quality, it is then determined whether the communication paths in the second direction satisfy a communication requirement. Finally, a particular communication path of unacceptable quality in the second direction is detected when the particular communication path in the second direction fails to satisfy the communication requirement. Weniger anzeigen

In one embodiment, a request to make a prediction regarding one or more service level agreements (SLAs) in a network is received. A network traffic parameter and an SLA requirement associated with the network traffic parameter according to the one or more SLAs are also determined. In addition, a performance metric associated with traffic in the network that corresponds to the determined network traffic parameter is estimated. It may then be predicted whether the SLA requirement would be… Mehr anzeigen

In one embodiment, a request to make a prediction regarding one or more service level agreements (SLAs) in a network is received. A network traffic parameter and an SLA requirement associated with the network traffic parameter according to the one or more SLAs are also determined. In addition, a performance metric associated with traffic in the network that corresponds to the determined network traffic parameter is estimated. It may then be predicted whether the SLA requirement would be satisfied based on the estimated performance metric. Weniger anzeigen

In one embodiment, a message instructing a particular node to act as a heartbeat relay agent is received at the particular node in a network. The particular node is selected to receive the message based on a centrality of the particular node. Heartbeat messages are then collected from child nodes of the particular node in the network. Based on the collected heartbeat messages, a heartbeat report is generated, and the report is transmitted to a collecting node in the network.