Back to results
US 12,756,618 B2Granted
Network anomaly detection and mitigation
AssigneeHewlett Packard Enterprise Development LP
InventorEbrahim Safavi
Life of this patent
Estimating the term…
Abstract
A network management system may detect congestion and other network problems, identify the root cause of the issue and invoke remedial actions. The network management system may collect a time series of network data from various devices in the network. The network management system may use the collected network data to determine metrics indicating whether the network is experiencing congestion and/or anomalies, and if so, what is the root cause. Once the root cause is identified an automated and/or manual corrective action may take place.
Claims17
A method comprising:
- obtaining, by a computing system, network data collected by a plurality of network devices in a network;
- detecting, by the computing system, an anomaly in the network, the anomaly having an associated anomaly time period;
- determining, by the computing system and based on the network data, a representative value for each network device of the plurality of network devices based on a time series of statistics for each network device within the anomaly time period;
- determining, by the computing system, a representative value for the network based on an aggregated time series of statistics for the network within the anomaly time period;
- calculating, by the computing system, a mutual information coefficient for each network device of the plurality of network devices that is representative of mutual dependence between the representative value for each network device and the representative value for the network;
- and
- determining, by the computing system, that a first network device of the plurality of network devices is related to the anomaly based on the representative value for the first network device being more correlated to the representative value for the network than representative values for other network devices of the plurality of network devices.
4 more elements
A computing device comprising:
- a memory;
- and
- one or more processors coupled to the memory and configured to:
- obtain network data collected by a plurality of network devices in a network;
- detect an anomaly in the network, the anomaly having an associated anomaly time period;
- determine, based on the network data, a representative value for each network device of the plurality of network devices based on a time series of statistics for each network device within the anomaly time period;
- determine a representative value for the network based on an aggregated time series of statistics for the network within the anomaly time period;
- calculate a mutual information coefficient for each network device of the plurality of network devices that is representative of mutual dependence between the representative value for each network device and the representative value for the network;
- and
- determine that a first network device of the plurality of network devices is related to the anomaly based on the representative value for the first network device being more correlated to the representative value for the network than representative values for other network devices of the plurality of network devices.
7 more elements
Non-transitory computer-readable storage media comprising instructions that, when executed, cause one or more processors to:
- obtain network data collected by a plurality of network devices in a network;
- detect an anomaly in the network, the anomaly having an associated anomaly time period;
- determine, based on the network data, a representative value for each network device of the plurality of network devices based on a time series of statistics for each network device within the anomaly time period;
- determine a representative value for the network based on an aggregated time series of statistics for the network within the anomaly time period;
- calculate a mutual information coefficient for each network device of the plurality of network devices that is representative of mutual dependence between the representative value for each network device and the representative value for the network;
- and
- determine that a first network device of the plurality of network devices is related to the anomaly based on the representative value for the first network device being more correlated to the representative value for the network than representative values for other network devices of the plurality of network devices.
4 more elements
Dependencies are inferred from the claim text.