# US 2020/0396129 A1 · Learning robust and accurate rules for device classification from clusters of devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396129 A1 - Document ID: US20200396129A1 - Status: Published application - Kind: A1 - Application number: 16/459,834 - Filed: 2019-07-02 - Published: 2020-12-17 - Earliest claimed: 2019-06-11 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: David Tedaldi; Grégory Mermoud; Pierre-Andre Savalle; Jean-Philippe Vasseur - Web page: https://patentgrep.com/patent/US20200396129A1 ## CPC - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0894: Policy-based network configuration management - H04L 41/32: {Specific management aspects for broadband networks} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/065: related to network devices - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In various embodiments, a device classification service obtains traffic telemetry data for a plurality of devices in a network. The service applies clustering to the traffic telemetry data, to form device clusters. The service generates a device classification rule based on a particular one of the device clusters. The service receives feedback from a user interface regarding the device classification rule. The service adjusts the device classification rule based on the received feedback. ## Claims ### Claim 1 A method, comprising: obtaining, by a device classification service, traffic telemetry data for a plurality of devices in a network; applying, by the service, clustering to the traffic telemetry data, to form device clusters; generating, by the service, a device classification rule based on a particular one of the device clusters, the device classification comprising one or more conditions needed to be met to assign a device label to a device in the network; receiving, at the service, feedback from a user interface regarding the device classification rule, the feedback indicative of whether the one or more conditions accurately assign the device label to the device; and adjusting, by the service, the device classification rule based on the received feedback wherein adjusting the device classification rule based on the received feedback comprises: determining that the rule refers to the same device type as that of another device type classification rule; and merging the two rules into a combined device type classification rule. ### Claim 2 (depends on 1) The method as in claim 1, wherein the adjusted device classification rule is used to assign the device type label to the device in the network based on the traffic telemetry data associated with that device. ### Claim 3 (depends on 2) The method as in claim 2, wherein the device type label is indicative of one or more of: a manufacturer of the device to which the label was assigned, a model of that device, or a version associated with that device. ### Claim 4 (depends on 1) The method as in claim 1, wherein the feedback indicates one of: the rule having too many conditions, the rule having too few conditions, or the rule allowing different manufacturers. ### Claim 5 (canceled) ### Claim 6 (depends on 1) The method as in claim 1, further comprising: providing the adjusted device classification rule for storage by a cloud-based unified rule database. ### Claim 7 (depends on 1) The method as in claim 1, wherein applying clustering to the traffic telemetry data, to form device clusters comprises: applying a first clustering approach to the traffic telemetry data, to form a first set of device clusters; providing data regarding one of the device clusters in the first set to the user interface; receiving feedback from the user interface regarding the device cluster in the first set that indicates that the cluster should be broken up; and applying a second clustering approach to the traffic telemetry data, to form a second set of clusters, wherein the second set of clusters comprises more device clusters than that of the first set. ### Claim 8 (depends on 7) The method as in claim 7, wherein the first and second clustering approaches use different objective functions. ### Claim 9 (depends on 7) The method as in claim 7, wherein the data regarding the device cluster in the first set is provided to the user interface based in part on a determination that the number of device clusters in the first set is below an upper bound threshold. ### Claim 10 (depends on 7) The method as in claim 7, wherein the data regarding the device cluster in the first set comprises a recommendation as to how to break-up that cluster. ### Claim 11 An apparatus, comprising: one or more network interfaces to communicate with one or more networks; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: obtain traffic telemetry data for a plurality of devices in a network; apply clustering to the traffic telemetry data, to form device clusters; generate a device classification rule based on a particular one of the device clusters, the device classification comprising one or more conditions needed to be met to assign a device label to a device in the network; receive feedback from a user interface regarding the device classification rule, the feedback indicative of whether the one or more conditions accurately assign the device label to the device; and adjust the device classification rule based on the received feedback, wherein adjusting the device classification rule based on the received feedback comprises: determining that the rule refers to the same device type as that of another device type classification rule; and merging the two rules into a combined device type classification rule. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the adjusted device classification rule is used to assign the device type label to the device in the network based on the traffic telemetry data associated with that device. ### Claim 13 (depends on 12) The apparatus as in claim 12, wherein the device type label is indicative of one or more of: a manufacturer of the device to which the label was assigned, a model of that device, or a version associated with that device. ### Claim 14 (depends on 11) The apparatus as in claim 11, wherein the feedback indicates one of: the rule having too many conditions, the rule having too few conditions, or the rule allowing different manufacturers. ### Claim 15 (canceled) ### Claim 16 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further configured to: provide the adjusted device classification rule for storage by a cloud-based unified rule database. ### Claim 17 (depends on 1) The method as in claim 1, wherein the apparatus applies clustering to the traffic telemetry data, to form device clusters by: applying a first clustering approach to the traffic telemetry data, to form a first set of device clusters; providing data regarding one of the device clusters in the first set to the user interface; receiving feedback from the user interface regarding the device cluster in the first set that indicates that the cluster should be broken up; and applying a second clustering approach to the traffic telemetry data, to form a second set of clusters, wherein the second set of clusters comprises more device clusters than that of the first set. ### Claim 18 A method, comprising: applying, by a device classification service, a first clustering approach to the traffic telemetry data, to form a first set of device clusters; providing, by the service, data regarding one of the device clusters in the first set to a user interface; receiving, at the service, feedback from an end user via the user interface regarding the device cluster in the first set that indicates that the cluster should be broken up; and applying, by the service, a second clustering approach to the traffic telemetry data, to form a second set of clusters, wherein the second set of clusters comprises more device clusters than that of the first set. ### Claim 19 (depends on 18) The method as in claim 18, wherein the data regarding the device cluster in the first set is provided to the user interface based in part on a determination that the number of device clusters in the first set is below an upper bound threshold. ### Claim 20 (depends on 18) The method as in claim 18, wherein the data regarding the device cluster in the first set comprises a recommendation as to how to break-up that cluster.