# US 10,771,313 B2 · Using random forests to generate rules for causation analysis of network anomalies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,313 B2 - Document ID: US10771313B2 - Status: Granted - Kind: B2 - Application number: 15/881,909 - Filed: 2018-01-29 - Published: 2019-08-01 - Granted: 2020-09-08 - Earliest claimed: 2018-01-29 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: David Tedaldi; Grégory Mermoud; Jean-Philippe Vasseur - Web page: https://patentgrep.com/patent/US10771313B2 ## CPC - H04L 41/0636: {based on a decision tree analysis} - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 41/16: using machine learning or artificial intelligence - H04L 41/5025: by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a network assurance service receives one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space. The network assurance service applies machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous. The network assurance service identifies, based on the labeled one or more sets of network characteristics, an anomaly pattern as a collection of unidimensional cutoffs in the feature space. The network assurance service initiates a change to the network based on the identified anomaly pattern. ## Claims ### Claim 1 A method comprising: receiving, at a network assurance service, one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space; applying, by the network assurance service, machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous; identifying, by the network assurance service and based on the labeled one or more sets of network characteristics, a plurality of anomaly patterns, each anomaly pattern including a plurality of unidimensional cutoffs in the feature space; and initiating, by the network assurance service, a change to the network based on the identified plurality of anomaly patterns, wherein the identifying of the plurality of anomaly patterns comprises: identifying, by the network assurance service, a first anomaly pattern including a first plurality of unidimensional cutoffs in the feature space; and identifying, by the network assurance service, one or more subsequent anomaly patterns, each of which including a subsequent plurality of unidimensional cutoffs in the feature space that satisfy the first plurality of unidimensional cutoffs of the first anomaly pattern, until a stopping criterion is met. ### Claim 2 (depends on 1) The method as in claim 1, wherein identifying the plurality of anomaly patterns comprises: training, by the network assurance service and using the labeled one or more sets of network characteristics as training data, a machine learning-based classifier to output a cutoff for a particular dimension in the feature space. ### Claim 3 (depends on 1) The method as in claim 1, wherein identifying the plurality of anomaly patterns comprises: training, by the network assurance service and using the labeled one or more sets of network characteristics as training data, a plurality of machine learning-based classifiers to output cutoffs for a particular dimension in the feature space; and identifying, by the network assurance service, a particular unidimensional cutoff in the feature space as an average of the cutoffs output by the plurality of trained classifiers. ### Claim 4 (depends on 1) The method as in claim 1, wherein the change to the network comprises at least one of: assigning a wireless access point to a different channel, replacing network equipment, or adjusting resource reservations in the network to satisfy a service level agreement. ### Claim 5 (depends on 1) The method as in claim 1, wherein initiating the change to the network based on the identified plurality of anomaly patterns comprises: sending, by the network assurance service, display data indicative of the identified plurality of anomaly patterns to a user interface. ### Claim 6 (depends on 1) The method as in claim 1, further comprising: applying, by the network assurance service, weights to the one or more sets of network characteristics using a decay function. ### Claim 7 (depends on 1) The method as in claim 1, wherein the network characteristics are indicative of one or more of: client count for a wireless access point, interference information for the wireless access point, channel information for the wireless access point, or traffic information for traffic associated with the wireless access point. ### Claim 8 (depends on 1) The method as in claim 1, wherein identifying the plurality of anomaly patterns comprises: assessing, by the network assurance service, different potential cutoffs for a particular dimension in the feature space as one of the unidimensional cutoffs, until a stopping criterion is met. ### Claim 9 (depends on 8) The method as in claim 8, wherein the stopping criterion indicates at least one of: a precision or recall for any of the plurality of anomaly patterns. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: receive one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space; apply learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous; identify, based on the labeled one or more sets of network characteristics, a plurality of anomaly patterns, each anomaly pattern including plurality of unidimensional cutoffs in the feature space; and initiate a change to the network based on the identified plurality of anomaly patterns, wherein the identifying of the plurality of anomaly patterns comprises: identifying, by the network assurance service, a first anomaly pattern including a first plurality of unidimensional cutoffs in the feature space; and identifying, by the network assurance service, one or more subsequent anomaly patterns, each of which including a subsequent plurality of unidimensional cutoffs in the feature space that satisfy the first plurality of unidimensional cutoffs of the first anomaly pattern, until a stopping criterion is met. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the apparatus identifies the plurality of anomaly patterns by: training, using the labeled one or more sets of network characteristics as training data, a machine learning-based classifier to output a cutoff for a particular dimension in the feature space. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the apparatus identifies the plurality of anomaly patterns by: training, using the labeled one or more sets of network characteristics as training data, a plurality of machine learning-based classifiers to output cutoffs for a particular dimension in the feature space; and identifying a particular unidimensional cutoff in the feature space as an average of the cutoffs output by the plurality of trained classifiers. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the change to the network comprises at least one of: assigning a wireless access point to a different channel, replacing network equipment, or adjusting resource reservations in the network to satisfy a service level agreement. ### Claim 14 (depends on 10) The apparatus as in claim 10, wherein the apparatus initiates the change to the network based on the identified plurality of anomaly patterns by: sending display data indicative of the identified plurality of anomaly patterns to a user interface. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further configured to: apply weights to the one or more sets of network characteristics using a decay function. ### Claim 16 (depends on 10) The apparatus as in claim 10, wherein the network characteristics are indicative of one or more of: client count for a wireless access point, interference information for the wireless access point, channel information for the wireless access point, or traffic information for traffic associated with the wireless access point. ### Claim 17 (depends on 10) The apparatus as in claim 10, wherein the apparatus identifies the plurality of anomaly patterns by: assessing different potential cutoffs for a particular dimension in the feature space as one of the unidimensional cutoffs, until a stopping criterion is met. ### Claim 18 (depends on 17) The apparatus as in claim 17, wherein the stopping criterion indicates at least one of: a precision or recall for any of the plurality of anomaly patterns. ### Claim 19 A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service to execute a process comprising: receiving, at the network assurance service, a plurality of one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space; applying, by the network assurance service, machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous; identifying, by the network assurance service and based on the labeled one or more sets of network characteristics, a plurality of anomaly patterns, each anomaly pattern including a plurality of unidimensional cutoffs in the feature space; and initiating, by the network assurance service, a change to the network based on the identified plurality of anomaly patterns, wherein the identifying of the plurality of anomaly patterns comprises: identifying, by the network assurance service, a first anomaly pattern including a first plurality of unidimensional cutoffs in the feature space; and identifying, by the network assurance service, one or more subsequent anomaly patterns, each of which including a subsequent plurality of unidimensional cutoffs in the feature space that satisfy the first plurality of unidimensional cutoffs of the first anomaly pattern, until a stopping criterion is met. ### Claim 20 (depends on 19) The computer-readable medium as in claim 19, wherein identifying the plurality of anomaly patterns comprises: assessing, by the network assurance service, different potential cutoffs for a particular dimension in the feature space as one of the unidimensional cutoffs, until a stopping criterion is met.