Back to results
US 11,893,456 B2Granted
Device type classification using metric learning in weakly supervised settings
AssigneeCisco Technology, Inc.
InventorsDavid Tedaldi, Pierre-Andre Savalle, Sharon Shoshana Wulff, Jean-Philippe Vasseur, Grégory Mermoud
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device classification service receives telemetry data indicative of behavioral characteristics of a plurality of devices in a network. The service obtains side information for the telemetry data. The service applies metric learning to the telemetry data and side information, to construct a distance function. The service uses the distance function to cluster the telemetry data into device clusters. The service associates a device type label with a particular device cluster.
Claims12
A method comprising:
- receiving, at a device classification service, telemetry data indicative of behavioral characteristics of a plurality of devices in a network;
- obtaining, by the service, side information for the telemetry data by:
- providing, to a user interface, the telemetry data for a pair of the plurality of devices selected by the service based on a measure of pairwise similarity between their behavioral characteristics, and providing, to the use interface, an option for a user to reject the pair selected based on the measure of pairwise similarity as dissimilar, wherein the side information comprises an indication from the user interface as to whether the user considers the pair to be similar or dissimilar;
- wherein the service selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster;
- applying, by the service, metric learning to the telemetry data and side information, to construct a distance function;
- using, by the service, the distance function to cluster the telemetry data into device clusters;
- and
- associating, by the service, a device type label with a particular device cluster,
- wherein the service selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster.
6 more elements
An apparatus, comprising:
- one or more network interfaces to communicate with one or more networks;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed configured to:
- receive telemetry data indicative of behavioral characteristics of a plurality of devices in a network;
- obtain side information for the telemetry data by:
- providing, to a user interface, the telemetry data for a pair of the plurality of devices selected by the apparatus based on a measure of pairwise similarity between their behavioral characteristics, and providing, to the user interface, an option for a user to reject the pair selected based on the measure of pairwise similarity as dissimilar, wherein the side information comprises an indication from the user interface as to whether the user considers the pair to be similar or dissimilar;
- wherein the service selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster;
- apply metric learning to the telemetry data and side information, to construct a distance function;
- use the distance function to cluster the telemetry data into device clusters;
- and
- associate a device type label with a particular device cluster,
- wherein the apparatus selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster.
10 more elements
A tangible, non-transitory, computer-readable medium storing program instructions that cause a device classification service to execute a process comprising:
- receiving, at the device classification service, telemetry data indicative of behavioral characteristics of a plurality of devices in a network;
- obtaining, by the service, side information for the telemetry data by:
- providing, to a user interface, the telemetry data for a pair of the plurality of devices selected by the service based on a measure of pairwise similarity between their behavioral characteristics, and providing, to the user interface, an option for a user to reject the pair selected based on the measure of pairwise similarity as dissimilar, wherein the side information comprises an indication from the user interface as to whether the user considers the pair to be similar or dissimilar;
- wherein the service selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster;
- applying, by the service, metric learning to the telemetry data and side information, to construct a distance function;
- using, by the service, the distance function to cluster the telemetry data into device clusters;
- and
- associating, by the service, a device type label with a particular device cluster,
- wherein the service selects the pair of devices based on the telemetry data for the pair of devices being close to each other in a feature space and the pair of devices not belonging to the same device cluster.
6 more elements
Dependencies are inferred from the claim text.