# US 2018/0027004 A1 · Multi-dimensional system anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027004 A1 - Document ID: US20180027004A1 - Status: Published application - Kind: A1 - Application number: 15/350,717 - Filed: 2016-11-14 - Published: 2018-01-25 - Earliest claimed: 2016-07-19 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Xinyuan Huang; Sarvesh Ranjan; Olivia Zhang; Yathiraj B. Udupi; Debojyoti Dutta - Web page: https://patentgrep.com/patent/US20180027004A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 63/162: {at the data link layer} - H04L 41/16: using machine learning or artificial intelligence - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device in a network receives a first plurality of measurements for network metrics captured during a first time period. The device determines a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period. The device receives a second plurality of measurements for the network metrics captured during a second time period. The device determines a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period. The device identifies a difference between the first and second sets of correlations between the network metrics as a network anomaly. ## Claims ### Claim 1 A method comprising: receiving, at a device in a network, a first plurality of measurements for network metrics captured during a first time period; determining, by the device, a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period; receiving, at the device, a second plurality of measurements for the network metrics captured during a second time period; determining, by the device, a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period; and identifying, by the device, a difference between the first and second sets of correlations between the network metrics as a network anomaly. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: generating, by the device, an alert indicative of the network anomaly. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: projecting, by the device, the first and second pluralities of measurements onto one or more hyperplanes that each comprise a hash function, to generate measurement signatures; and using, by the device, the measurement signatures to determine the first and second sets of correlations. ### Claim 4 (depends on 3) The method as in claim 3, wherein the measurement signatures comprises hashes of the projected first and second pluralities of measurements. ### Claim 5 (depends on 1) The method as in claim 1, further comprising: performing, by the device, spectral analysis on the first and second pluralities of measurements, to determine the first and second sets of correlations. ### Claim 6 (depends on 1) The method as in claim 1, further comprising: generating, by the device, persistence diagrams as sets of topological features from the first and second pluralities of measurements; and computing, by the device, a distance between the generated persistence diagrams. ### Claim 7 (depends on 6) The method as in claim 6, wherein the topological features comprise clusters and holes of one or more manifolds in which measurements from the first or second pluralities of measurements are data points in the one or more manifolds. ### Claim 8 (depends on 1) The method as in claim 1, wherein the network metrics comprise at least one of: a byte size of a traffic flow, a time associated with a traffic flow, or an available resource of a node in the network. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: receive a first plurality of measurements for network metrics captured during a first time period; determine a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period; receive a second plurality of measurements for the network metrics captured during a second time period; determine a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period; and identify a difference between the first and second sets of correlations between the network metrics as a network anomaly. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further operable to: generate an alert indicative of the network anomaly. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further operable to: project the first and second pluralities of measurements onto one or more hyperplanes that each comprise a hash function, to generate measurement signatures; and use the measurement signatures to determine the first and second sets of correlations. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the measurement signatures comprises hashes of the projected first and second pluralities of measurements. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further operable to: perform spectral analysis on the first and second pluralities of measurements, to determine the first and second sets of correlations. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further operable to: generate persistence diagrams as sets of topological features from the first and second pluralities of measurements; and compute a distance between the generated persistence diagrams. ### Claim 15 (depends on 14) The apparatus as in claim 14, wherein the topological features comprise clusters and holes of one or more manifolds in which measurements from the first or second pluralities of measurements are data points in the one or more manifolds. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the network metrics comprise at least one of: a byte size of a traffic flow, a time associated with a traffic flow, or an available resource of a node in the network. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising: receiving a first plurality of measurements for network metrics captured during a first time period; determining a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period; receiving a second plurality of measurements for the network metrics captured during a second time period; determining a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period; and identifying a difference between the first and second sets of correlations between the network metrics as a network anomaly. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, wherein the process further comprises: generating an alert indicative of the network anomaly. ### Claim 19 (depends on 17) The computer-readable medium as in claim 17, wherein the process further comprises: performing spectral analysis on the first and second pluralities of measurements, to determine the first and second sets of correlations. ### Claim 20 (depends on 17) The computer-readable medium as in claim 17, wherein the process further comprises: using locality-sensitive hashing to identify the network anomaly.