Automatic retraining of machine learning models to detect ddos attacks
AssigneeCisco Technology, Inc.
InventorsK. Tirumaleswar Reddy, Daniel G. Wing, Blake Harrell Anderson, David McGrew
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network receives an attack mitigation request regarding traffic in the network. The device causes an assessment of the traffic, in response to the attack mitigation request. The device determines that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic. The device causes an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
Claims20
A method comprising:
- receiving, at a device in a network, an attack mitigation request regarding traffic in the network;
- causing, by the device, an assessment of the traffic, in response to the attack mitigation request;
- determining, by the device, that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic;
- and
- causing, by the device, an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed operable to:
- receive an attack mitigation request regarding traffic in the network;
- cause an assessment of the traffic, in response to the attack mitigation request;
- determine that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic;
- and
- cause an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
- receiving, at the device, an attack mitigation request regarding traffic in the network;
- causing an assessment of the traffic, in response to the attack mitigation request;
- determining, by the device, that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic;
- and
- causing, by the device, an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
Dependencies are inferred from the claim text.