Back to results
US 11,451,451 B2Granted
Intent-based analytics
AssigneeApstra, Inc.
InventorsAleksandar Luka Ratkovic, Jonathan Thambidurai, Maksim Kulkin
Life of this patent
Estimating the term…
Abstract
In performing network analysis, a first declarative specification and a second declarative specification are received. The first declarative specification specifies a dynamically updating query associated with networking components of a computer network. Dynamically updated results of the dynamically updating query are processed. An indication of a detected anomaly is provided based at least in part on a result of the updated dynamically updated results of the dynamically updating query.
Claims20
A method of network analysis performed by one or more processors, the method comprising:
- receiving a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of a network and wherein the collector element is configured to collect results from the network based on the dynamically updating query;
- receiving a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected by the collector element;
- executing the collector element based on the first declarative specification and executing the processing element based on the second declarative specification, wherein executing the collector element and the processing element comprises, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfiguring at least one of the collector element or the processing element using one or more of the first declarative specification and the second declarative specification;
- and
- providing an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network.
2 more elements
A system for network analysis comprising:
- one or more processors configured to:
- receive a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of a network and wherein the collector element is configured to collect results from the network based on the dynamically updating query;
- receive a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected by the collector element;
- execute the collector element based on the first declarative specification and execute the processing element based on the second declarative specification, wherein, to execute the collector element and the processing element, the one or more processors are configured to, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfigure at least one of the collector, element or the processing element, using one or more of the first declarative specification and the second declarative specification;
- and
- provide an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network;
- and
- a memory coupled to at least one of the one or more processors and configured to provide at least one of the one or more processors with instructions.
5 more elements
A non-transitory computer readable medium comprising instructions for causing one or more processors to:
- receive a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of the network and wherein the collector element is configured to collect results from the network based on the dynamically updating query;
- receive a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected the collector element;
- execute the collector element based on the first declarative specification and execute the processing element based on the second declarative specification, wherein the instructions that cause the one or more processors to execute the collector element and the processing element cause the one or more processors to, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfigure at least one of the collector element or the processing element using one or more of the first declarative specification and the second declarative specification;
- and
- provide an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network.
2 more elements
Dependencies are inferred from the claim text.