Cold start mechanism to prevent compromise of automatic anomaly detection systems
AssigneeCisco Technology, Inc.
InventorsFabien Flacher, Grégory Mermoud, Jean-Philippe Vasseur, Sukrit Dasgupta
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.
Claims20
A method, comprising:
- analyzing, by a device in a network, data indicative of a behavior of the network using a supervised anomaly detection model;
- determining, by the device, whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data;
- suspending, by the device, training of the unsupervised anomaly detection model, in response to determining that the supervised anomaly detection model has detected an anomaly in the network;
- and
- training, by the device, an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the network interfaces and adapted to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed configured to:
- analyze data indicative of a behavior of the network using a supervised anomaly detection model;
- determine whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data;
- suspend training of the unsupervised anomaly detection model, in response to determining that the supervised anomaly detection model has detected an anomaly in the network;
- and
- train an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.
A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor configured to:
- analyze data indicative of a behavior of a network using a supervised anomaly detection model;
- determine whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data;
- suspend training of the unsupervised anomaly detection model, in response to determining that the supervised anomaly detection model has detected an anomaly in the network;
- and
- train an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.
Dependencies are inferred from the claim text.