Anomaly detection for a networking device based on monitoring related sets of counters
AssigneeCisco Technology, Inc.
InventorsPengywan Wang, Brian Weis
Life of this patent
Estimating the term…
Abstract
In one embodiment, a monitoring process identifies a set of counters maintained by a networking device by comparing a configuration of the networking device to an object relationship model. The monitoring process obtains counter values from the identified set of counters maintained by the networking device. The monitoring process detects an anomaly by using the obtained counter values as input to a machine learning-based anomaly detector. The monitoring process generates an anomaly detection alert for the detected anomaly.
Claims20
A method comprising:
- identifying, by a monitoring process, a set of counters maintained by a networking device by comparing a configuration of the networking device to an object relationship model;
- obtaining, by the monitoring process, counter values from the identified set of counters maintained by the networking device;
- detecting, by the monitoring process, an anomaly by using the obtained counter values as input to a machine learning-based anomaly detector;
- and
- generating, by the monitoring process, an anomaly detection alert for the detected anomaly.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed configured to:
- identify a set of counters maintained by a networking device by comparing a configuration of the networking device to an object relationship model;
- obtain counter values from the identified set of counters maintained by the networking device;
- detect an anomaly by using the obtained counter values as input to a machine learning-based anomaly detector;
- and
- generate an anomaly detection alert for the detected anomaly.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a monitoring service to execute a process comprising:
- identifying, by the monitoring process, a set of counters maintained by a networking device by comparing a configuration of the networking device to an object relationship model;
- obtaining, by the monitoring process, counter values from the identified set of counters maintained by the networking device;
- detecting, by the monitoring process, an anomaly by using the obtained counter values as input to a machine learning-based anomaly detector;
- and
- generating, by the monitoring process, an anomaly detection alert for the detected anomaly.
Dependencies are inferred from the claim text.