# US 11,115,280 B2 · Data-driven identification of features related to a state change of a network component > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,280 B2 - Document ID: US11115280B2 - Status: Granted - Kind: B2 - Application number: 16/789,723 - Filed: 2020-02-13 - Published: 2021-03-25 - Granted: 2021-09-07 - Earliest claimed: 2019-09-20 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Wenqin Shao; Frank Brockners; Parisa Foroughi; Thomas Michel-Ange Feltin - Web page: https://patentgrep.com/patent/US11115280B2 ## CPC - H04L 43/0817: by checking functioning - H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies} - H04L 41/085: Retrieval of network configuration; Tracking network configuration history - H04L 41/0866: Checking the configuration - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques and mechanisms for automatically identifying counters/features of a network component that are related to a state change (or event) for the network component or for the network itself. For example, using data obtained from the network component around a time of the state change, delta averages for the features around the time of the state change may be determined. The delta averages may be utilized to determine which counters/features are most descriptive for a particular state change. The counter/features that are the most descriptive for a particular state change is as important as the change detection itself. This is especially true since in a case of an event/state change occurring, a large amount of counters/features may react to the state change or event. Thus, the techniques described herein provide for an approach to distill which counters/features contribute the most to a particular state change from a data driven perspective. ## Claims ### Claim 1 A computer-implemented method comprising: based at least in part on a state change at a networking component, obtaining data related to values of a plurality of features of the networking component, the data being within a primary window during which the state change occurred; evaluating the data using a delta-average based model, the delta-average based model evaluating the data within (i) a first window of the primary window, the first window including first data of the data prior to occurrence of the state change and (ii) a second window of the primary window, the second window including second data of the data after the occurrence of the state change; based at least in part on the evaluating the data with the delta-average based model, determining a change in mean values of the values for each feature of the plurality of features between the first window and the second window; based at least in part on the determining the change in mean values of the values for each feature of the plurality of features between the first window and the second window, determining a list of the plurality of features having largest changes in mean values between the first window and the second window, wherein the list represents most likely features contributing to the state change of the networking component; and providing the list to a user. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: wherein evaluating the data with the delta-average based model comprises eliminating a predetermined amount of the values for each feature of the plurality of features within (i) the first window and (ii) the second window. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising normalizing each value of the plurality of features by a maximum value of the first and second windows. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein evaluating the data comprises evaluating the data with respect to one or more of a difference in mean values of the features, a difference in variance of values of the features, a spike in values of the features, or a distance to reference data. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the list includes a predetermined number of features determined by the user. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the list includes a predetermined number of features based on heuristics. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: based on predetermined criteria, removing one or more features from the list. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the networking component comprises one of a router, a server, or a switch. ### Claim 9 One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising: based at least in part on a state change at a networking component, obtaining data related to values of a plurality of features of the networking component, the data being within a primary window during which the state change occurred; evaluating the data using a delta-average based model, the delta-average based model evaluating the data within (i) a first window of the primary window, the first window including first data of the data prior to occurrence of the state change and (ii) a second window of the primary window, the second window including second data of the data after the occurrence of the state change; based at least in part on the evaluating the data with the delta-average based model, determining a change in mean values of the values for each feature of the plurality of features between the first window and the second window; based at least in part on the determining the change in mean values of the values for each feature of the plurality of features between the first window and the second window, determining a list of the plurality of features having largest changes in mean values between the first window and the second window, wherein the list represents most likely features contributing to the state change of the networking component; and providing the list to a user. ### Claim 10 (depends on 9) The one or more non-transitory computer-readable media of claim 9, further comprising: wherein evaluating the data with the delta-average based model comprises eliminating a predetermined amount of the values for each feature of the plurality of features within (i) the first window and (ii) the second window. ### Claim 11 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the actions further comprise normalizing each value of the plurality of features by a maximum value of the first and second windows. ### Claim 12 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein evaluating the data comprises evaluating the data with respect to one or more of a difference in mean values of the features, a difference in variance of values of the features, a spike in values of the features, or a distance to reference data. ### Claim 13 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the actions further comprise: based on predetermined criteria, removing one or more features from the list. ### Claim 14 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the networking component comprises one of a router, a server, or a switch. ### Claim 15 A computer-implemented method comprising: obtaining data related to values of a plurality of features of a router, the data being within a primary window during which a state change occurred, the state change relating to the router; evaluating the data with respect to one or more of a difference in mean values of the features, a difference in variance of values of the features, a spike in values of the features, or a distance to reference data, wherein the evaluating the data comprises evaluating the data using a delta-average based model, the delta-average based model evaluating the data within (i) a first window of the primary window, the first window including first data of the data prior to occurrence of the state change and (ii) a second window of the primary window, the second window including second data of the data after the occurrence of the state change; based at least in part on the evaluating the data with the delta-average based model, determining a change in mean values of the values for each feature of the plurality of features between the first window and the second window; based at least in part on the evaluating the data, determining a list of the plurality of features having at least largest changes in mean values, and one or more of largest variance of values of the features, largest spike in values of the features, or largest distance to reference data, wherein the list represents most likely features contributing to the state change of the router; and providing the list of the plurality of features to a user. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, further comprising: eliminating a predetermined amount of the values for each feature of the plurality of features within the window. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, further comprising: based on predetermined criteria, removing one or more features from the list. ### Claim 18 (depends on 15) The computer-implemented method of claim 15, wherein the list comprises a predetermined number of features determined by one of the user or heuristics. ### Claim 19 (depends on 15) The computer-implemented method of claim 15, further comprising: normalizing each value of the plurality of features by a maximum value of the first and second windows. ### Claim 20 (depends on 15) The computer-implemented method of claim 15, wherein evaluating the data with the delta-average based model comprises eliminating a predetermined amount of the values for each feature of the plurality of features within (i) the first window and (ii) the second window.