# US 2019/0173762 A1 · Meta behavioral analytics for a network or system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173762 A1 - Document ID: US20190173762A1 - Status: Published application - Kind: A1 - Application number: 15/830,797 - Filed: 2017-12-04 - Published: 2019-06-06 - Earliest claimed: 2017-12-04 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Charles Calvin Byers; Gonzalo Salgueiro; Joseph Michael Clarke; M. David Hanes - Web page: https://patentgrep.com/patent/US20190173762A1 ## CPC - H04L 41/149: for prediction of maintenance - G06F 9/5083: {Techniques for rebalancing the load in a distributed system} - G06N 20/00: Machine learning - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/147: for predicting network behaviour - H04L 41/16: using machine learning or artificial intelligence - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Meta behavioral analytics techniques include, at one or more network devices that are operatively coupled to a plurality of behavioral analytics systems associated with a network or system, monitoring data outputs of the plurality of behavioral analytics systems that are representative of activity in the network or system. The one or more network devices correlate the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing different subject matter domains. Additionally, based on the correlating, the one or more network devices detect a previously unidentified condition in (a) the network or system; or (b) one of the plurality of behavioral analytics systems. ## Claims ### Claim 1 A method comprising: at one or more network devices that are operatively coupled to a plurality of behavioral analytics systems associated with a network or system, monitoring data outputs of the plurality of behavioral analytics systems that are representative of activity in the network or system; correlating the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing different subject matter domains; and based on the correlating, detecting a previously unidentified condition in: (a) the network or system; or (b) one of the plurality of behavioral analytics systems. ### Claim 2 (depends on 1) The method of claim 1, further comprising: automatically responding to remedy the previously unidentified condition. ### Claim 3 (depends on 2) The method of claim 2, wherein the automatically responding comprises at least one of: disabling one or more of the plurality of behavioral analytics systems; causing a portion of the network or system to be disabled; or rebalancing a load on the plurality of behavioral analytics systems. ### Claim 4 (depends on 1) The method of claim 1, further comprising: correlating the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing a same subject matter domain. ### Claim 5 (depends on 1) The method of claim 1, wherein the previously unidentified condition is a divergence between redundant behavioral analytics systems from the plurality of behavioral analytics systems and the detecting further comprises: detecting the divergence between the redundant behavioral analytics systems when the data outputs indicate that one of the redundant behavioral analytics systems is not identifying or not addressing errors in the network or system. ### Claim 6 (depends on 1) The method of claim 1, wherein the correlating employs machine learning algorithms and the method further comprises: continually updating the machine learning algorithms based on the correlating. ### Claim 7 (depends on 1) The method of claim 1, further comprising: generating a report with an indication of the previously unidentified condition and an overview of the network or system that is based on the correlating. ### Claim 8 (depends on 1) The method of claim 1, wherein the previously unidentified condition is a security breach of one of the plurality of behavioral analytics systems. ### Claim 9 A system comprising: a plurality of behavioral analytics systems associated with a network or system; and one or more network devices that are operatively coupled to the plurality of behavioral analytics systems and configured to: monitor data outputs of the plurality of behavioral analytics systems that are representative of activity in the network or system; correlate the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing different subject matter domains; and based on a correlation, detect a previously unidentified condition in: (a) the network or system; or (b) one of the plurality of behavioral analytics systems. ### Claim 10 (depends on 9) The system of claim 9, wherein the one or more network devices are further configured to: automatically respond to remedy the previously unidentified condition. ### Claim 11 (depends on 10) The system of claim 10, wherein, in automatically responding, the one or more network devices are further configured to perform at least one of the following operations: disabling one or more of the plurality of behavioral analytics systems; causing a portion of the network or system to be disabled; or rebalancing a load on the plurality of behavioral analytics systems. ### Claim 12 (depends on 9) The system of claim 9, wherein the one or more network devices are further configured to: correlate the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing a same subject matter domain. ### Claim 13 (depends on 9) The system of claim 9, wherein the previously unidentified condition is a divergence between redundant behavioral analytics systems from the plurality of behavioral analytics systems and, in detecting, the one or more network devices are further configured to: detect the divergence between the redundant behavioral analytics systems when the data outputs indicate that one of the redundant behavioral analytics systems is not identifying or not addressing errors in the network or system. ### Claim 14 (depends on 9) The system of claim 9, wherein the one or more network devices employ machine learning algorithms to correlate and the one or more network devices are further configured to: continually update the machine learning algorithms based on correlations. ### Claim 15 (depends on 9) The system of claim 9, wherein the one or more network devices are further configured to: generate a report with an indication of the previously unidentified condition and an overview of the network or system that is based on the correlating. ### Claim 16 (depends on 9) The system of claim 9, wherein the previously unidentified condition is a security breach of one of the plurality of behavioral analytics systems. ### Claim 17 One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to: monitor data outputs of a plurality of behavioral analytics systems that are representative of activity in a network or system; correlate the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing different subject matter domains; and based on a correlation, detect a previously unidentified condition in: (a) the network or system; or (b) one of the plurality of behavioral analytics systems. ### Claim 18 (depends on 17) The one or more non-transitory computer readable storage media of claim 17, further comprising instructions operable to: automatically respond to remedy the previously unidentified condition by at least one of: disabling one or more of the plurality of behavioral analytics systems; causing a portion of the network or system to be disabled; or rebalancing a load on the plurality of behavioral analytics systems. ### Claim 19 (depends on 17) The one or more non-transitory computer readable storage media of claim 17, further comprising instructions operable to: correlate the data outputs from two or more of the plurality of behavioral analytics systems that are dedicated to analyzing a same subject matter domain. ### Claim 20 (depends on 17) The one or more non-transitory computer readable storage media of claim 17, wherein the previously unidentified condition is a divergence between redundant behavioral analytics systems from the plurality of behavioral analytics systems and the instructions operable to detect further comprises instructions operable to: detect the divergence between the redundant behavioral analytics systems when the data outputs indicate that one of the redundant behavioral analytics systems is not identifying or not addressing errors in the network or system.