Anomaly detection triggered proactive rerouting for software as a service (SaaS) application traffic
AssigneeCisco Technology, Inc.
InventorsJean-Philippe Vasseur, Grégory Mermoud, Vinay Kumar Kolar
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device forms a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and a remote application. The device applies anomaly detection to the telemetry cluster, to identify one or more anomalies. The device makes a determination as to whether the one or more anomalies are attributable to the remote application or to the access network. The device initiates a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.
Claims18
A method comprising:
- forming, by a device, a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and a remote application;
- applying, by the device, anomaly detection to the telemetry cluster, to identify one or more anomalies;
- making, by the device, a determination as to whether the one or more anomalies are attributable to the remote application or to the access network by determining a temporal correlation between the one or more anomalies and changes to network destinations associated with the remote application;
- and
- initiating, by the device, a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.
An apparatus, comprising:
- one or more network interfaces;
- a processor coupled to the one or more network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process that is executable by the processor, the process when executed configured to:
- form a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and remote application;
- apply anomaly detection to the telemetry cluster, to identify one or more anomalies;
- make a determination as to whether the one or more anomalies are attributable to the remote application or to the access network by determining a temporal correlation between the one or more anomalies and changes to network destinations associated with the remote application;
- and
- initiate a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
- forming, by the device, a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and a remote application;
- applying, by the device, anomaly detection to the telemetry cluster, to identify one or more anomalies;
- making, by the device, a determination as to whether the one or more anomalies are attributable to the remote application or to the access network by determining a temporal correlation between the one or more anomalies and changes to network destinations associated with the remote application;
- and
- initiating, by the device, a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.
Dependencies are inferred from the claim text.