# US 10,484,255 B2 · Trustworthiness index computation in a network assurance system based on data source health monitoring

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,255 B2
- Document ID: US10484255B2
- Status: Granted
- Kind: B2
- Application number: 15/626,412
- Filed: 2017-06-19
- Published: 2018-12-20
- Granted: 2019-11-19
- Earliest claimed: 2017-06-19
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Andrea Di Pietro; Grégory Mermoud; Jean-Philippe Vasseur; Sukrit Dasgupta
- Web page: https://patentgrep.com/patent/US10484255B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- G06F 16/24578: {using ranking}
- G06N 3/09: Supervised learning
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06N 20/20: Ensemble learning
- H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP]
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 41/149: for prediction of maintenance
- H04L 43/0817: by checking functioning
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/08: Learning methods
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/04: Inference or reasoning models
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

## Claims

### Claim 1

A method comprising:
receiving, at a device, health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintaining, by the device, a performance model for the data source that models the health of the data source;
computing, by the device, a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjusting, by the device and based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

### Claim 2 (depends on 1)

The method as in claim 1, wherein the one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source comprise one or more weightings applied to the telemetry data.

### Claim 3 (depends on 1)

The method as in claim 1, wherein the performance model for the data source that models the health of the data source comprises an unsupervised machine learning-based model that determines a likeliness of the health status being observed for the data source.

### Claim 4 (depends on 1)

The method as in claim 1, wherein the performance model for the data source that models the health of the data source comprises a supervised machine learning-based model that was trained using a training set of health status data labeled with trustworthiness indexes.

### Claim 5 (depends on 1)

The method as in claim 1, wherein the health status data indicative of the health status of the data source comprises one or more of: a count of dropped telemetry packets of the provided telemetry data, resource utilization by the data source, a response delay of Simple Network Management Protocol (SNMP) queries associated with the data source, or a duration of time associated with performing an SNMP walk of the data source.

### Claim 6 (depends on 1)

The method as in claim 1, further comprising:
controlling, by the device, a frequency at which the health status data is reported to the device.

### Claim 7 (depends on 1)

The method as in claim 1, wherein the data source comprises a switch, router, network access point, or wireless controller in the network.

### Claim 8 (depends on 1)

The method as in claim 1, further comprising:
disabling, by the device, analysis of at least a portion of the telemetry data by the network analyzer based on the trustworthiness index computed for the telemetry data provided by the data source.

### Claim 9 (depends on 1)

The method as in claim 1, wherein the health status data differs from the telemetry data, and wherein the telemetry data is indicative of a behavior of one or more devices in the network that differ from the data source.

### Claim 10 (depends on 1)

The method as in claim 1, further comprising:
analyzing, by the device, the telemetry data using the network analyzer with the one or more adjusted parameters to determine a configuration change for the network; and
implementing, by the device, the determined configuration change for the network.

### Claim 11

An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintain a performance model for the data source that models the health of the data source;
compute a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjust, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

### Claim 12 (depends on 11)

The apparatus as in claim 11, wherein the one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source comprise one or more weightings applied to the telemetry data.

### Claim 13 (depends on 11)

The apparatus as in claim 11, wherein the performance model for the data source that models the health of the data source comprises an unsupervised machine learning-based model that determines a likeliness of the health status being observed for the data source.

### Claim 14 (depends on 11)

The apparatus as in claim 11, wherein the performance model for the data source that models the health of the data source comprises a supervised machine learning-based model that was trained using a training set of health status data labeled with trustworthiness indexes.

### Claim 15 (depends on 11)

The apparatus as in claim 11, wherein the health status data indicative of the health status of the data source comprises one or more of: a count of dropped telemetry packets of the provided telemetry data, resource utilization by the data source, a response delay of Simple Network Management Protocol (SNMP) queries associated with the data source, or a duration of time associated with performing an SNMP walk of the data source.

### Claim 16 (depends on 11)

The apparatus as in claim 11, wherein the process when executed is further configured to:
dynamically adjust which health status data is received based on the telemetry data from the data source that is analyzed by the machine learning-based network analyzer.

### Claim 17 (depends on 11)

The apparatus as in claim 11, wherein the process when executed is further configured to:
disable analysis of at least a portion of the telemetry data by the network analyzer based on the trustworthiness index computed for the telemetry data provided by the data source.

### Claim 18 (depends on 11)

The apparatus as in claim 11, wherein the health status data differs from the telemetry data, and wherein the telemetry data is indicative of a behavior of one or more devices in the network that differ from the data source.

### Claim 19 (depends on 11)

The apparatus as in claim 11, wherein the process when executed is further configured to:
analyze the telemetry data using the network analyzer with the one or more adjusted parameters to determine a configuration change for the network; and
implement the determined configuration change for the network.

### Claim 20

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
receiving, at the device, health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintaining, by the device, a performance model for the data source that models the health of the data source;
computing, by the device, a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjusting, by the device and based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.