# US 10,320,824 B2 · Anomaly detection using network traffic data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,824 B2 - Document ID: US10320824B2 - Status: Granted - Kind: B2 - Application number: 14/989,920 - Filed: 2016-01-07 - Published: 2016-07-28 - Granted: 2019-06-11 - Earliest claimed: 2015-01-22 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Jean-Philippe Vasseur; Grégory Mermoud; Laurent Sartran - Web page: https://patentgrep.com/patent/US10320824B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06N 20/00: Machine learning - H04L 45/22: {Alternate routing} - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 45/02: Topology update or discovery - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset. ## Claims ### Claim 1 A method comprising: receiving, at a device in a network, traffic metrics for a plurality of applications in the network; building, by the device, a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector; identifying, by the device, a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space; and adjusting, by the device, how traffic associated with the particular one of the plurality of applications is sent in through the network to capture the missing dataset. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: training, by the device, the anomaly detector with the feature space populated with the missing dataset; and detecting, by the device, an anomaly in the network by analyzing the received traffic metrics using the trained anomaly detector. ### Claim 3 (depends on 1) The method as in claim 1, wherein adjusting how traffic is sent in the network comprises: altering, by the device, a differentiated services code point (DSCP) value for a particular type of traffic; and routing the particular type of traffic using the altered DSCP value. ### Claim 4 (depends on 1) The method as in claim 1, wherein adjusting how traffic is sent in the network comprises: identifying, by the device, an alternate path in the network for traffic for the particular application; and routing, by the device, the traffic for the particular application along the alternate path. ### Claim 5 (depends on 1) The method as in claim 1, wherein identifying the alternate path comprises: querying, by the device, path information maintained by another device associated with a backup network interface. ### Claim 6 (depends on 1) The method as in claim 1, wherein the device adjusts how traffic is sent in the network, in response to determining that an importance of the missing dataset outweighs a cost associated with adjusting how the traffic is sent. ### Claim 7 (depends on 1) The method as in claim 1, wherein the device adjusts how traffic is sent in the network for the particular application, based on a policy associated with the particular application. ### Claim 8 (depends on 1) The method as in claim 1, wherein populating the feature space for the machine learning-based anomaly detector comprises: aggregating the received traffic metrics into fixed-size feature vectors. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a computer network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed configured to: receive traffic metrics for a plurality of applications in the network; build a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector; identify a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space; and adjust how traffic associated with the particular one of the plurality of applications is sent through the network, to capture the missing dataset. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: train the anomaly detector with the feature space populated with the missing dataset; and detect an anomaly in the network by analyzing the received traffic metrics using the trained anomaly detector. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus adjusts how the traffic is sent in the network by: altering a differentiated services code point (DSCP) value associated with a particular type of traffic; and routing the particular type of traffic using the altered DSCP value. ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the apparatus adjusts how the traffic is sent in the network by: identifying an alternate path in the network for traffic for the particular application; and routing the traffic for the particular application along the alternate path. ### Claim 13 (depends on 12) The apparatus as in claim 12, wherein the apparatus identifies the alternate path by: querying path information maintained by another device associated with a backup network interface. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the apparatus adjusts how traffic is sent in the network, in response to determining that an importance of the missing dataset outweighs a cost associated with adjusting how the traffic is sent. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the apparatus adjusts how the traffic is sent in the network, based on a policy associated with the particular application. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the apparatus populates the feature space for the machine learning-based anomaly detector by: aggregating the received traffic metrics into fixed-size feature vectors. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a computer to execute a process comprising: receiving traffic metrics for a plurality of applications in the network; building a feature space for a machine learning-based anomaly detector based on the received traffic metrics, wherein the feature space is made up of fixed-length feature vectors from the received traffic metrics and uses the feature vectors as input to the machine learning-based anomaly detector; identifying a missing dataset in the feature space of a machine learning algorithm of the machine learning based anomaly detector for a particular one of the plurality of applications, wherein the missing dataset is an inferred unobserved network property in the feature space of the machine learning algorithm associated with the particular one of the plurality of applications that results in the feature space only being partially observed, wherein the anomaly detector is configured to infer a behavior of traffic for a first application based on a behavior of traffic for a second application represented in the feature space; and adjusting how traffic associated with the particular one of the plurality of applications is sent in through the network to capture the missing dataset. ### Claim 18 (depends on 17) The tangible, non-transitory, computer-readable medium as in claim 17, wherein the process further comprises: training the anomaly detector with the feature space populated with the missing dataset; and detecting an anomaly in the network by analyzing the received traffic metrics using the trained anomaly detector.