# US 11,451,456 B2 · Learning stable representations of devices for clustering-based device classification systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,456 B2 - Document ID: US11451456B2 - Status: Granted - Kind: B2 - Application number: 16/389,013 - Filed: 2019-04-19 - Published: 2020-10-22 - Granted: 2022-09-20 - Earliest claimed: 2019-04-19 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: David Tedaldi; Grégory Mermoud; Pierre-Andre Savalle; Jean-Philippe Vasseur - Web page: https://patentgrep.com/patent/US11451456B2 ## CPC - H04L 41/0893: Assignment of logical groups to network elements - G06N 3/045: Combinations of networks - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/0495: Quantised networks; Sparse networks; Compressed networks - G06N 3/08: Learning methods - G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning - G06N 3/091: Active learning - G06N 3/098: Distributed learning, e.g. federated learning - G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn - G06N 20/00: Machine learning - H04L 41/16: using machine learning or artificial intelligence - H04L 43/065: related to network devices - H04L 43/0817: by checking functioning - H04L 41/0894: Policy-based network configuration management - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device classification service obtains telemetry data for a plurality of devices in a network. The device classification service repeatedly assigns the devices to device clusters by applying clustering to the obtained telemetry data. The device classification service determines a measure of stability loss associated with the cluster assignments. The measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster. The device classification service determines, based on the measure of stability loss, that the cluster assignments have stabilized. The device classification service obtains device type labels for the device clusters, after determining that the cluster assignments have stabilized. ## Claims ### Claim 1 A method, comprising: obtaining, by a device classification service, telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network; repeatedly assigning, by the device classification service, the devices to device clusters by applying clustering to the obtained telemetry data; determining, by the device classification service, a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster; determining, by the device classification service and based on the measure of stability loss, that the cluster assignments have stabilized; and obtaining, by the device classification service, device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters. ### Claim 2 (depends on 1) The method as in claim 1, wherein the obtained telemetry data is indicative of traffic features of traffic associated with the devices and observed in the network. ### Claim 3 (depends on 1) The method as in claim 1, wherein repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data comprises: using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and using the lower dimensional representation of the telemetry data as input to a clustering process. ### Claim 4 (depends on 3) The method as in claim 3, wherein the device classification service is a cloud-based service, the method further comprising: deploying the autoencoder to the network, to send the lower dimensional representation of the telemetry data to the cloud-based service. ### Claim 5 (depends on 3) The method as in claim 3, further comprising: using the cluster assignments as classification loss labels for the autoencoder. ### Claim 6 (depends on 1) The method as in claim 1, wherein the device type labels are indicative of a device operating system, a device manufacturer, a device make, a device model, or a device function. ### Claim 7 (depends on 1) The method as in claim 1, wherein the device type labels are obtained through active labeling by requesting labels from one or more expert users. ### Claim 8 (depends on 1) The method as in claim 1, further comprising: determining that a particular device belongs to a particular one of the device clusters; and assigning device type label for the particular device cluster to the particular device. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: obtain telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network; repeatedly assign the devices to device clusters by applying clustering to the obtained telemetry data; determine a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster; determine, based on the measure of stability loss, that the cluster assignments have stabilized; and obtain device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the obtained telemetry data is indicative of traffic features of traffic associated with the devices and observed in the network. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data by: using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and using the lower dimensional representation of the telemetry data as input to a clustering process. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further configured to: deploy the autoencoder to the network of the devices, to send the lower dimensional representation of the telemetry data to the apparatus. ### Claim 13 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further configured to: use the cluster assignments as classification loss labels for the autoencoder. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the device type labels are indicative of a device operating system, a device manufacturer, a device make, a device model, or a device function. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the device type labels are obtained through active labeling by requesting labels from one or more expert users. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: determine that a particular device belongs to a particular one of the device clusters; and assign device type label for the particular device cluster to the particular device. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device classification service to execute a process comprising: obtaining, by the device classification service, telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network; repeatedly assigning, by the device classification service, the devices to device clusters by applying clustering to the obtained telemetry data; determining, by the device classification service, a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster; determining, by the device classification service and based on the measure of stability loss, that the cluster assignments have stabilized; and obtaining, by the device classification service, device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, wherein repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data comprises: using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and using the lower dimensional representation of the telemetry data as input to a clustering process. ### Claim 19 (depends on 18) The computer-readable medium as in claim 18, wherein the device classification service is a cloud-based service, the process further comprising: deploying the autoencoder to the network, to send the lower dimensional representation of the telemetry data to the cloud-based service. ### Claim 20 (depends on 18) The computer readable medium as in claim 18, wherein the process further comprises: using the cluster assignments as classification loss labels for the autoencoder.