# US 10,375,100 B2 · Identifying anomalies in a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,100 B2
- Document ID: US10375100B2
- Status: Granted
- Kind: B2
- Application number: 15/795,670
- Filed: 2017-10-27
- Published: 2019-05-02
- Granted: 2019-08-06
- Earliest claimed: 2017-10-27
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Mark Grayson; Santosh Ramrao Patil; Gangadharan Byju Pularikkal
- Web page: https://patentgrep.com/patent/US10375100B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04W 12/12: Detection or prevention of fraud
- H04W 24/00: Supervisory, monitoring or testing arrangements
- H04W 24/04: Arrangements for maintaining operational condition
- H04W 24/08: Testing, {supervising or monitoring} using real traffic
- H04W 76/27: Transitions between radio resource control [RRC] states
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Various implementations disclosed herein enable identifying anomalies in a network. For example, in various implementations, a method of identifying anomalies in a network is performed by a network node. In various implementations, the network node includes one or more processors, and a non-transitory memory. In various implementations, the method includes generating a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type. In various implementations, the method includes determining, based on communications associated with the first device, a performance indicator that indicates a performance of the first device. In various implementations, the method includes synthesizing an anomaly indicator as a function of the performance indicator in relation to the characteristic indicator.

## Claims

### Claim 1

A method comprising:
at a network node including a non-transitory memory, and one or more processors coupled with the non-transitory memory:
generating a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type, wherein the characteristic indicator indicates a threshold for the device type;
determining, based on communications associated with the first device, a performance indicator that indicates a performance of the first device; and
synthesizing an anomaly indicator in response to the performance indicator breaching the threshold for the device type.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating the characteristic indicator comprises:
generating the characteristic indicator for the device type based on individual characteristic indicators of respective devices in the device type.

### Claim 3 (depends on 2)

The method of claim 2, wherein the characteristic indicator for the device type is an average of the individual characteristic indicators.

### Claim 4 (depends on 1)

The method of claim 1, wherein the communications include one or more of non-access stratum (NAS) messages and radio resource control (RRC) messages.

### Claim 5 (depends on 1)

The method of claim 1, wherein:
the characteristic indicator indicates a mobility threshold for the device type;
the performance indicator indicates a mobility of the first device; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the mobility of the first device breaching the mobility threshold for the device type.

### Claim 6 (depends on 1)

The method of claim 1, wherein:
the characteristic indicator indicates a data throughput threshold for the device type;
the performance indicator indicates a data throughput of the first device; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the data throughput of the first device breaching the data throughput threshold for the device type.

### Claim 7 (depends on 1)

The method of claim 1, wherein:
the characteristic indicator indicates a threshold number of cell handover requests for the device type over a given period of time;
the performance indicator indicates a number of cell handover requests for the first device requested over the given period of time; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the number of cell handover requests for the first device breaching the threshold number of cell handover requests for the device type.

### Claim 8

An anomaly detector comprising:
a processor provided to execute computer readable instructions included on a non-transitory memory; and
a non-transitory memory including computer readable instructions, that when executed by the processor, cause the anomaly detector to:
generate a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type, wherein the characteristic indicator indicates a threshold for the device type;
determine, based on communications associated with the first device, a performance indicator that indicates a performance of the first device; and
synthesize an anomaly indicator in response to the performance indicator breaching the threshold for the device type.

### Claim 9 (depends on 8)

The anomaly detector of claim 8, wherein generating the characteristic indicator comprises:
generating the characteristic indicator for the device type based on individual characteristic indicators of respective devices in the device type.

### Claim 10 (depends on 9)

The anomaly detector of claim 9, wherein the characteristic indicator for the device type is an average of the individual characteristic indicators.

### Claim 11 (depends on 8)

The anomaly detector of claim 8, wherein the communications include one or more of non-access stratum (NAS) messages and radio resource control (RRC) messages.

### Claim 12 (depends on 8)

The anomaly detector of claim 8, wherein:
the characteristic indicator indicates a mobility threshold for the device type;
the performance indicator indicates a mobility of the first device; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the mobility of the first device breaching the mobility threshold for the device type.

### Claim 13 (depends on 8)

The anomaly detector of claim 8, wherein:
the characteristic indicator indicates a data throughput threshold for the device type;
the performance indicator indicates a data throughput of the first device; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the data throughput of the first device breaching the data throughput threshold for the device type.

### Claim 14 (depends on 8)

The anomaly detector of claim 8, wherein:
the characteristic indicator indicates a threshold number of cell handover requests for the device type over a given period of time;
the performance indicator indicates a number of cell handover requests for the first device requested over the given period of time; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the number of cell handover requests for the first device breaching the threshold number of cell handover requests for the device type.

### Claim 15 (depends on 8)

The anomaly detector of claim 8, wherein synthesizing the anomaly indicator comprises:
transmitting the anomaly indicator.

### Claim 16 (depends on 8)

The anomaly detector of claim 8, wherein synthesizing the anomaly indicator comprises:
transmitting a command that limits an operation of the first device.

### Claim 17 (depends on 8)

The anomaly detector of claim 8, wherein determining the performance indicator comprises:
analyzing one or more of NAS messages and RRC messages communicated by the first device; and
determining the performance indicator based on one or more of the NAS messages and the RRC messages communicated by the first device.

### Claim 18 (depends on 8)

The anomaly detector of claim 8, wherein the computer readable instructions further cause the anomaly detector to:
update the characteristic indicator based on additional communications associated with the first device.

### Claim 19

A non-transitory computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which, when executed by an anomaly detector with a processing device, cause the anomaly detector to perform or cause performance of:
generating a characteristic indicator that characterizes a device type based on communications associated with a first device of the device type, wherein the characteristic indicator indicates a threshold for the device type;
determining, based on communications associated with the first device, a performance indicator that indicates a performance of the first device; and
synthesizing an anomaly indicator in response to the performance indicator breaching the threshold for the device type.

### Claim 20 (depends on 19)

The non-transitory computer readable storage medium of claim 19, wherein:
the characteristic indicator indicates a mobility threshold for the device type;
the performance indicator indicates a mobility of the first device; and
synthesizing the anomaly indicator comprises synthesizing the anomaly indicator in response to the mobility of the first device breaching the mobility threshold for the device type.