# US 10,771,331 B2 · Closed loop control for fixing network configuration issues to aid in device classification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,331 B2 - Document ID: US10771331B2 - Status: Granted - Kind: B2 - Application number: 16/182,761 - Filed: 2018-11-07 - Published: 2020-05-07 - Granted: 2020-09-08 - Earliest claimed: 2018-11-07 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Grégory Mermoud; Pierre-André Savalle; Jean-Philippe Vasseur; Kevin Gagnon - Web page: https://patentgrep.com/patent/US10771331B2 ## CPC - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/131: Protocols for games, networked simulations or virtual reality - H04L 41/16: using machine learning or artificial intelligence - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - Y02D 30/00: Reducing energy consumption in communication networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE ## Abstract In one embodiment, a device receives traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types. The device compares the telemetry data from a particular one of the networks to the telemetry data from the other networks to identify one or more traffic characteristics that are missing from the telemetry data for one or more endpoints of the particular network. The device identifies a networking entity in the particular network that is common to the one or more endpoints for which the one or more characteristics are missing. The device determines a configuration change for the networking entity by comparing a current configuration of the entity to those of one or more entities in the other networks. The device initiates implementation of the determined configuration change for the entity in the particular network. ## Claims ### Claim 1 A method comprising: receiving, at a device, traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types; forming, by the device, a matrix of traffic characteristics and associated endpoints from the traffic telemetry data; determining, by the device, that one or more entries of the matrix are empty, the one or more empty entries of the matrix corresponding to one or more traffic characteristics that are missing from the traffic telemetry data for one or more endpoints of a particular network; identifying, by the device, a networking entity in the particular network that is common to the one or more endpoints for which the one or more traffic characteristics are missing; determining, by the device, a configuration change for the networking entity by comparing a current configuration of the networking entity to those of one or more networking entities in the other networks; and initiating, by the device, implementation of the determined configuration change for the networking entity in the particular network. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: using matrix completion to add one or more entries to the matrix, wherein the added one or more entries correspond to the missing one or more traffic characteristics. ### Claim 3 (depends on 2) The method as in claim 2, wherein forming the matrix of traffic characteristics and associated endpoints from the traffic telemetry data comprises: applying a binary mask to the traffic characteristics used to form the matrix, wherein the binary mask uses binary values to indicate whether traffic of a given endpoint in the matrix exhibited a given traffic characteristic. ### Claim 4 (depends on 3) The method as in claim 3, wherein using matrix completion to add one or more entries to the matrix comprises: matching the traffic characteristics for the given endpoint to a pattern of traffic characteristics exhibited by other endpoints, wherein the pattern of traffic characteristics includes the missing one or more traffic characteristics. ### Claim 5 (depends on 1) The method as in claim 1, further comprising: monitoring, by the device, whether the implemented configuration change to the networking entity prevented device type classifications for the one or more endpoints from oscillating. ### Claim 6 (depends on 1) The method as in claim 1, wherein initiating, by the device, implementation of the determined configuration change for the networking entity in the particular network comprises: providing, by the device, an indication of the configuration change to a user interface. ### Claim 7 (depends on 1) The method as in claim 1, wherein the one or more missing traffic characteristics comprise a Hypertext Transfer Protocol (HTTP) feature, a Dynamic Host Configuration Protocol (DHCP) feature, an organizationally unique identifier (OUI), a Link Layer Discovery Protocol (LLDP) feature, or manufacturer usage description (MUD) information. ### Claim 8 (depends on 1) The method as in claim 1, wherein determining the configuration change for the networking entity by comparing the current configuration of the networking entity to those of one or more networking entities in the other networks comprises: forming a mapping of one or more configuration parameters to the missing one or more traffic characteristics. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: receive traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types; form a matrix of traffic characteristics and associated endpoints from the traffic telemetry data; determine that one or more entries of the matrix are empty, the one or more empty entries of the matrix corresponding to one or more traffic characteristics that are missing from the traffic telemetry data for one or more endpoints of a particular network; identify a networking entity in the particular network that is common to the one or more endpoints for which the one or more traffic characteristics are missing; determine a configuration change for the networking entity by comparing a current configuration of the networking entity to those of one or more networking entities in the other networks; and initiate implementation of the determined configuration change for the networking entity in the particular network. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: using matrix completion to add one or more entries to the matrix, wherein the added one or more entries correspond to the missing one or more traffic characteristics. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the apparatus forms the matrix of traffic characteristics and associated endpoints from the traffic telemetry data by: applying a binary mask to the traffic characteristics used to form the matrix, wherein the binary mask uses binary values to indicate whether traffic of a given endpoint in the matrix exhibited a given traffic characteristic. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the apparatus uses matrix completion to add one or more entries to the matrix by: matching the traffic characteristics for the given endpoint to a pattern of traffic characteristics exhibited by other endpoints, wherein the pattern of traffic characteristics includes the missing one or more traffic characteristics. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: monitor whether the implemented configuration change to the networking entity prevented device type classifications for the one or more endpoints from oscillating. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the apparatus initiates implementation of the determined configuration change for the networking entity in the particular network by: providing an indication of the configuration change to a user interface. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the one or more missing traffic characteristics comprise a Hypertext Transfer Protocol (HTTP) feature, a Dynamic Host Configuration Protocol (DHCP) feature, an organizationally unique identifier (OUI), a Link Layer Discovery Protocol (LLDP) feature, or manufacturer usage description (MUD) information. ### Claim 16 (depends on 9) The apparatus as in claim 9 wherein the apparatus determines the configuration change for the networking entity by comparing the current configuration of the networking entity to those of one or more networking entities in the other networks by: forming a mapping of one or more configuration parameters to the missing one or more traffic characteristics. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: receiving, at the device, traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types; forming, by the device, a matrix of traffic characteristics and associated endpoints from the traffic telemetry data; determining, by the device, that one or more entries of the matrix are empty, the one or more empty entries of the matrix corresponding to one or more traffic characteristics that are missing from the traffic telemetry data for one or more endpoints of a particular network; identifying, by the device, a networking entity in the particular network that is common to the one or more endpoints for which the one or more traffic characteristics are missing; determining, by the device, a configuration change for the networking entity by comparing a current configuration of the networking entity to those of one or more networking entities in the other networks; and initiating, by the device, implementation of the determined configuration change for the networking entity in the particular network. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, wherein the process further comprises: using matrix completion to add one or more entries to the matrix, wherein the added one or more entries correspond to the missing one or more traffic characteristics. ### Claim 19 (depends on 18) The computer-readable medium as in claim 18, wherein forming the matrix of traffic characteristics and associated endpoints from the traffic telemetry data comprises: applying a binary mask to the traffic characteristics used to form the matrix, wherein the binary mask uses binary values to indicate whether traffic of a given endpoint in the matrix exhibited a given traffic characteristic. ### Claim 20 (depends on 17) The computer-readable medium as in claim 17, wherein the process further comprises: monitoring, by the device, whether the implemented configuration change to the networking entity prevented device type classifications for the one or more endpoints from oscillating.