# US 11,451,451 B2 · Intent-based analytics > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,451 B2 - Document ID: US11451451B2 - Status: Granted - Kind: B2 - Application number: 16/916,783 - Filed: 2020-06-30 - Published: 2020-10-15 - Granted: 2022-09-20 - Earliest claimed: 2017-12-08 - Assignees: Apstra, Inc. - Applicants: Apstra, Inc. - Inventors: Aleksandar Luka Ratkovic; Jonathan Thambidurai; Maksim Kulkin - Web page: https://patentgrep.com/patent/US11451451B2 ## CPC - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - G06F 16/2379: {Updates performed during online database operations; commit processing} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/951: Indexing; Web crawling techniques - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/06: Generation of reports - H04L 43/0817: by checking functioning - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In performing network analysis, a first declarative specification and a second declarative specification are received. The first declarative specification specifies a dynamically updating query associated with networking components of a computer network. Dynamically updated results of the dynamically updating query are processed. An indication of a detected anomaly is provided based at least in part on a result of the updated dynamically updated results of the dynamically updating query. ## Claims ### Claim 1 A method of network analysis performed by one or more processors, the method comprising: receiving a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of a network and wherein the collector element is configured to collect results from the network based on the dynamically updating query; receiving a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected by the collector element; executing the collector element based on the first declarative specification and executing the processing element based on the second declarative specification, wherein executing the collector element and the processing element comprises, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfiguring at least one of the collector element or the processing element using one or more of the first declarative specification and the second declarative specification; and providing an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network. ### Claim 2 (depends on 1) The method of claim 1, wherein the dynamically updating query is for a graph representation of networking components of the network. ### Claim 3 (depends on 2) The method of claim 2, wherein the graph representation includes a computing infrastructure node and a computing infrastructure edge; wherein the computing infrastructure node comprises one or more of an identifier, a type, a label, a tag, or a property; and wherein the computing infrastructure edge comprises one or more of an identifier, a type, a label, a tag, a source node, a target node, or a property. ### Claim 4 (depends on 2) The method of claim 2, wherein telemetry data of networking components of the network is stored in the graph representation. ### Claim 5 (depends on 1) The method of claim 1, wherein the dynamically updating query identifies a pattern of an interrelated set of infrastructure nodes and infrastructure edges of the network. ### Claim 6 (depends on 1) The method of claim 1, wherein the detected anomaly indicates an anomaly in a performance of the network. ### Claim 7 (depends on 1) The method of claim 1, wherein the method is at least in part performed as a part of a directed acyclic graph of stages in performing the network analysis. ### Claim 8 (depends on 1) The method of claim 1, wherein executing the processing element comprises aggregating a result of the results the dynamically updating query with a previous result of a previous processing. ### Claim 9 (depends on 8) The method of claim 8, wherein the detected anomaly is based at least in part on the aggregated result. ### Claim 10 (depends on 1) The method of claim 1, wherein the first declarative specification and the second declarative specification are included in an HTTP POST request. ### Claim 11 (depends on 1) The method of claim 1, wherein the indication of the detected anomaly is provided via a graphical user interface. ### Claim 12 (depends on 1) The method of claim 1, wherein the indication of the detected anomaly is provided via a streaming message. ### Claim 13 (depends on 1) The method of claim 1, further comprising automatically performing a responsive action based on the indication of the detected anomaly. ### Claim 14 (depends on 1) The method of claim 1, wherein providing the indication of the detected anomaly includes providing an analysis report of telemetry data gathered from one or more networking components of the network. ### Claim 15 A system for network analysis comprising: one or more processors configured to: receive a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of a network and wherein the collector element is configured to collect results from the network based on the dynamically updating query; receive a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected by the collector element; execute the collector element based on the first declarative specification and execute the processing element based on the second declarative specification, wherein, to execute the collector element and the processing element, the one or more processors are configured to, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfigure at least one of the collector, element or the processing element, using one or more of the first declarative specification and the second declarative specification; and provide an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network; and a memory coupled to at least one of the one or more processors and configured to provide at least one of the one or more processors with instructions. ### Claim 16 (depends on 15) The system of claim 15, wherein the dynamically updating query is for a graph representation of networking components of the network. ### Claim 17 (depends on 16) The system of claim 16, wherein telemetry data of networking components of the network is stored in the graph representation. ### Claim 18 (depends on 15) The system of claim 15, wherein the one or more processors are further configured to automatically perform a responsive action based on the indication of the detected anomaly. ### Claim 19 (depends on 15) The system of claim 15, wherein the one or more processors are configured to provide the indication of the detected anomaly including by being configured to provide an analysis report of telemetry data gathered from one or more networking components of the network. ### Claim 20 A non-transitory computer readable medium comprising instructions for causing one or more processors to: receive a first declarative specification that specifies a dynamically updating query for a collector element, wherein the dynamically updating query identifies criteria for matching a portion of the network and wherein the collector element is configured to collect results from the network based on the dynamically updating query; receive a second declarative specification that specifies a processing element separate from the collector element and configured to process the results collected the collector element; execute the collector element based on the first declarative specification and execute the processing element based on the second declarative specification, wherein the instructions that cause the one or more processors to execute the collector element and the processing element cause the one or more processors to, in response to an identification of a detected change in the network that would affect the dynamically updating query, reconfigure at least one of the collector element or the processing element using one or more of the first declarative specification and the second declarative specification; and provide an indication of a detected anomaly based on the at least one of the collector element or the processing element being reconfigured due to the detected change in the network.