Back to results
US 10,320,824 B2Granted
Anomaly detection using network traffic data
AssigneeCisco Technology, Inc.
InventorsJean-Philippe Vasseur, Grégory Mermoud, Laurent Sartran
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset.
Claims18
A method comprising:
- receiving, at a device in a network, traffic metrics for a plurality of applications in the network;
- building, by the device, a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector;
- identifying, by the device, a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space;
- and
- adjusting, by the device, how traffic associated with the particular one of the plurality of applications is sent in through the network to capture the missing dataset.
2 more elements
An apparatus, comprising:
- one or more network interfaces to communicate with a computer network;
- a processor coupled to the one or more network interfaces and configured to execute a process;
- and
- a memory configured to store the process executable by the processor, the process when executed configured to:
- receive traffic metrics for a plurality of applications in the network;
- build a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector;
- identify a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space;
- and
- adjust how traffic associated with the particular one of the plurality of applications is sent through the network, to capture the missing dataset.
6 more elements
A tangible, non-transitory, computer-readable medium storing program instructions that cause a computer to execute a process comprising:
- receiving traffic metrics for a plurality of applications in the network;
- building a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector;
- identifying a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space;
- and
- adjusting how traffic associated with the particular one of the plurality of applications is sent in through the network to capture the missing dataset.
2 more elements
Dependencies are inferred from the claim text.