# US 12,008,486 B2 · Cognitive automation for networking, security, IoT, and collaboration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,486 B2 - Document ID: US12008486B2 - Status: Granted - Kind: B2 - Application number: 17/173,380 - Filed: 2021-02-11 - Published: 2021-09-09 - Granted: 2024-06-11 - Earliest claimed: 2020-03-03 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Hugo Latapie; Ozkan Kilic; Ramana Rao V. R. Kompella; Myungjin Lee; Simon Matthew Young - Web page: https://patentgrep.com/patent/US12008486B2 ## CPC - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 5/043: Distributed expert systems; Blackboards - G06N 3/042: Knowledge-based neural networks; Logical representations of neural networks - G06N 3/045: Combinations of networks - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/08: Learning methods - G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning - G06N 3/09: Supervised learning - G06N 3/098: Distributed learning, e.g. federated learning - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 5/02: Knowledge representation; Symbolic representation - G06N 5/046: Forward inferencing; Production systems - G06N 20/00: Machine learning - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device maintains a metamodel that describes a monitored system. The metamodel comprises a plurality of layers ranging from a sub-symbolic space to a symbolic space. The device tracks updates to the metamodel over time. The device updates the metamodel based in part on sub-symbolic time series data generated by the monitored system. The device receives, from a learning agent, a request for the updates to a particular layer of the metamodel associated with a specified time period. The device provides, to the learning agent, data indicative of one or more updates to the particular layer of the metamodel associated with the specified time period. ## Claims ### Claim 1 A method comprising: maintaining, by a device, a metamodel that describes a monitored system, the metamodel comprising a plurality of layers ranging from a sub-symbolic space to a symbolic space and a knowledge graph that represents symmetric relations between concepts in the knowledge graph; tracking, by the device, updates to the metamodel over time comprising an update to a node in the plurality of layers or a relation in the knowledge graph, wherein the device updates the metamodel based in part on sub-symbolic time series data generated by the monitored system; receiving, at the device and from a learning agent, a request for the updates to a particular layer or a particular relation of the metamodel associated with a specified time period; and providing, by the device and to the learning agent, data indicative of one or more updates to the particular layer or the particular relation of the metamodel associated with the specified time period. ### Claim 2 (depends on 1) The method as in claim 1, wherein the sub-symbolic time series data generated by the monitored system comprises video data. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: using a semantic reasoning engine on the symbolic space to make an inference about the monitored system. ### Claim 4 (depends on 3) The method as in claim 3, further comprising: providing an indication of the inference about the monitored system to a user interface. ### Claim 5 (depends on 1) The method as in claim 1, wherein the monitored system comprises a distributed computing environment. ### Claim 6 (depends on 1) The method as in claim 1, wherein the device comprises a network router, switch, or gateway. ### Claim 7 (depends on 6) The method as in claim 6, wherein the learning agent is executed by a different network router, switch, or gateways as that of the device. ### Claim 8 (depends on 1) The method as in claim 1, wherein providing the data indicative of the one or more updates to the particular layer of the metamodel associated with the specified time period comprises: forming the data indicative of the one or more updates by using an autoencoder to compress the sub-symbolic time series data. ### Claim 9 (depends on 1) The method as in claim 1, further comprising: loading a subset of the metamodel into a short-term memory; and evaluating the subset of the metamodel as a focus of attention. ### Claim 10 An apparatus, comprising: a network interface to communicate with a computer network; a processor coupled to the network interface and configured to execute one or more processes; and a memory configured to store a process that is executed by the processor, the process when executed configured to: maintain a metamodel that describes a monitored system, the metamodel comprising a plurality of layers ranging from a sub-symbolic space to a symbolic space and a knowledge graph that represents symmetric relations between concepts in the knowledge graph; track updates to the metamodel over time comprising an update to a node in the plurality of layers or a relation in the knowledge graph, wherein the apparatus updates the metamodel based in part on sub-symbolic time series data generated by the monitored system; receive, from a learning agent, a request for the updates to a particular layer or a particular relation of the metamodel associated with a specified time period; and provide, to the learning agent, data indicative of one or more updates to the particular layer or the particular relation of the metamodel associated with the specified time period. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the sub-symbolic time series data generated by the monitored system comprises video data. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further configured to: use a semantic reasoning engine on the symbolic space to make an inference about the monitored system. ### Claim 13 (depends on 12) The apparatus as in claim 12, wherein the process when executed is further configured to: provide an indication of the inference about the monitored system to a user interface. ### Claim 14 (depends on 10) The apparatus as in claim 10, wherein the monitored system comprises a distributed computing environment. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the apparatus comprises a network router, switch, or gateway. ### Claim 16 (depends on 15) The apparatus as in claim 15, wherein the learning agent is executed by a different network router, switch, or gateways as that of the apparatus. ### Claim 17 (depends on 10) The apparatus as in claim 10, wherein the apparatus provides the data indicative of the one or more updates to the particular layer of the metamodel associated with the specified time period by: forming the data indicative of the one or more updates by using an autoencoder to compress the sub-symbolic time series data. ### Claim 18 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: maintaining, by a first learning agent executed by the device, a metamodel that describes a monitored system, the metamodel comprising a plurality of layers ranging from a sub-symbolic space to a symbolic space and a knowledge graph that represents symmetric relations between concepts in the knowledge graph; tracking, by the first learning agent, updates to the metamodel over time comprising an update to a node in the plurality of layers or a relation in the knowledge graph, wherein the first learning agent updates the metamodel based in part on sub-symbolic time series data generated by the monitored system; receiving, at the first learning agent and from a second learning agent, a request for the updates to a particular layer or a particular relation of the metamodel associated with a specified time period; and providing, by the first learning agent and to the second learning agent, data indicative of one or more updates to the particular layer or the particular relation of the metamodel associated with the specified time period.