Data visualization in self-learning networks

An apparatus, comprising:

• one or more network interfaces to communicate with a self-learning network (SLN);
• a processor coupled to the network interfaces and adapted to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• receive from distributed learning agent (DLA) in the SLN a summary of raw traffic flow information from one or more devices in the SLN, wherein the summary comprises a statistical model representing the raw traffic flow information obtained the first device;
• transform the summary of raw traffic flow information that is presented on a user interface;
• transmit the transformed summary of raw traffic flow information to the user interface;
• request at least a portion of the raw traffic flow information from the one or more devices, wherein the requested portion of the raw traffic flow information is an update to the summary related to an anomalous traffic flow;
• transmit the requested at least a portion of the raw traffic flow information to the user interface, wherein apparatus operates as a supervisory and control agent in the SLN;
• and
• instruct the one or more devices to adjust communications sent from the one or more devices to the apparatus so as not to interfere with network traffic based on the portion of the raw traffic flow information.

An apparatus, comprising:

• one or more network interfaces to communicate with a self-learning network (SLN);
• a processor coupled to the network interfaces and adapted to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• maintain, by a distributed learning agent (DLA) executing on the apparatus, raw traffic flow information for the SLN;
• summarize, by the DLA, the raw traffic flow information into a summary of the raw traffic flow information obtained by the first device, the summary comprising a statistical model representing the raw traffic flow information obtained the first device;
• transmit, by the DLA, the summary of the raw traffic flow information to a device in the SLN, wherein the device executes a supervisory and control agent that transform the summary that is presented on a user interface;
• detect, by the DLA, an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector;
• update, by the DLA, the summary based on the detected anomalous traffic flow;
• and
• adaptively transmit, by the DLA, at least a portion of the raw traffic flow information related to the anomalous traffic flow to the second device as an update to the previously transmitted summary;
• receive, by the DLA, an instruction from the device based on the portion of raw traffic flow information related to the anomalous traffic flow and received by the device;
• and
• in response to receiving the instruction from the device, adjust, by the DLA, communications sent from the apparatus to the device so as not to interfere with network traffic.