Back to results
US 10,757,121 B2Granted
Distributed anomaly detection management
AssigneeCisco Technology, Inc.
InventorsSukrit Dasgupta, Jean-Philippe Vasseur, Andrea Di Pietro
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network performs anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network. The device identifies an ability of one or more nodes in the network to perform at least one of the anomaly detection functions. The device selects a particular one of the anomaly detection functions to offload to a particular one of the nodes, based on the ability of the particular node to perform the particular anomaly detection function. The device instructs the particular node to perform the selected anomaly detection function.
Claims13
A method comprising:
- performing, by a device in a network, anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in a branch network, wherein the device is an edge switch or an edge router that connects one or more host devices and one or more intermediate devices in the branch network to the network;
- identifying, by the device, an ability of one or more nodes in the branch network to perform at least one of the anomaly detection functions, wherein the one or more nodes are the one or more host devices or the one or more intermediate devices in the branch network;
- dynamically selecting, by the device, a particular one of the anomaly detection functions to offload to a particular node of the one or more nodes, based on the ability of the particular node to perform the particular anomaly detection function, wherein the particular node is a switch or router in the branch network;
- based on the dynamic selection, offloading, by the device, the selected anomaly detection function to the particular node by instructing the particular node to perform the selected anomaly detection function, wherein offloading includes:
- instructing, by the device, one or more of the nodes to forward traffic data to the particular node, and
- instructing, by the device, the particular node to compute at least a portion of an anomaly detection model for the anomaly detector using the forwarded traffic data;
- training, by the device, the anomaly detection model;
- and
- providing, by the device, parameters of the trained anomaly detection model to the particular node to compute at least a portion of the model by updating the model.
6 more elements
An apparatus, comprising:
- one or more network interfaces to communicate with a network and a branch network;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed operable to:
- perform anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network, wherein the apparatus is an edge switch or an edge router that connects one or more host devices and one or more intermediate devices in a branch network to the network;
- identify an ability of one or more nodes in the branch network to perform at least one of the anomaly detection functions, wherein the one or more nodes are the one or more host devices or the one or more intermediate devices in the branch network;
- dynamically select a particular one of the anomaly detection functions to offload to a particular node of the one or more nodes, based on the ability of the particular node to perform the particular anomaly detection function, wherein the particular node comprises a switch or router in the branch network;
- and
- based on the dynamic selection, offload the selected anomaly detection function from the apparatus to the particular node by instructing the particular node to perform the selected anomaly detection function, wherein offloading includes:
- instructing one or more of the nodes to forward traffic data to the particular node, and
- instructing the particular node to compute at least a portion of an anomaly detection model for the anomaly detector using the forwarded traffic data;
- train the anomaly detection model;
- and
- provide parameters of the trained anomaly detection model to the particular node to compute at least a portion of the model by updating the model.
11 more elements
A method comprising:
- identifying, by a device in a network, a set of one or more nodes in a branch network connected to the network that convey intra-branch traffic, wherein the device is an edge switch or an edge router that connects the set of one or more nodes to the network;
- providing, by the device, the set of nodes that convey intra-branch traffic to a supervisory device;
- receiving, at the device, a selection from the supervisory device of one of the set of nodes that conveys intra-branch traffic, wherein the supervisory device dynamically selects a node that conveys intra-branch traffic based on an ability of the selected node to perform a particular anomaly detection function, wherein the node is a switch or router in the branch network;
- instructing, by the device, the selected node that conveys intra-branch traffic instead of the device to capture traffic data regarding at least a portion of the intra-branch traffic for assessment by a machine learning-based anomaly detector, wherein instructing includes:
- instructing the selected node to capture traffic associated with a particular host in the branch network;
- and
- instructing, by the device, the selected node to compute at least a portion of an anomaly detection model for the anomaly detector using the captured traffic;
- training, by the device, the anomaly detection model;
- and
- providing, by the device, parameters of the trained anomaly detection model to the selected node to compute at least a portion of the model by updating the model.
7 more elements
Dependencies are inferred from the claim text.