# US 2020/0404084 A1 · Faulty distributed system component identification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0404084 A1 - Document ID: US20200404084A1 - Status: Published application - Kind: A1 - Application number: 17/012,314 - Filed: 2020-09-04 - Published: 2020-12-24 - Earliest claimed: 2018-08-23 - Assignees: Morgan Stanley Services Group Inc. - Applicants: Morgan Stanley Services Group Inc. - Inventors: Richard Huddleston; Ahmed Jedda - Web page: https://patentgrep.com/patent/US20200404084A1 ## CPC - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/049: Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs - H04L 41/16: using machine learning or artificial intelligence - H04L 43/06: Generation of reports - H04L 43/0811: by checking connectivity - H04L 45/22: {Alternate routing} - H04L 45/58: Association of routers - H04L 45/70: {Routing based on monitoring results} - H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) - G06N 3/044: Recurrent networks, e.g. Hopfield networks - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/0817: by checking functioning - H04L 43/12: Network monitoring probes - H04L 43/16: Threshold monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for detecting a communications computer network node malfunction by analysis of network traffic output by the network node. Low latency packet capture nodes copy network traffic and transmit it to an analytics engine, which may use machine learning techniques, including long short-term memory (LSTM) neural networks, to determine a likelihood that the output of one data router in a network is suffering from a software malfunction, hardware malfunction, or network connectivity issue, and preserve overall data quality in the network by causing cessation of traffic by the malfunctioning node of the network. ## Claims ### Claim 1 A system for detecting a data router malfunction, comprising: one or more low-latency packet monitors, each associated with a data router that is configured to receive an input data stream and forward to a central repository an output data stream that is a copy of a selected subset of the input data stream, each of which is placed between its associated data router and the central repository along a network path, and each of which receives and forwards the output data stream to an analytics computing device; and the analytics computing device, storing electronic instructions that, when executed by a processor of the analytics computing device, cause the analytics computing device to: receive, from the one or more low-latency packet monitors, the forwarded output data stream over a series of time windows; feed data from the output data stream over the series of time windows into a long short-term memory (LSTM) neural network; using the LSTM neural network, determine a probability that the output stream of a particular data router comprises a corruption of the input data stream due to software failure or hardware failure in the particular data router; and responsive to a determination that the probability exceeds a predetermined threshold, transmit an electronic message to the particular data router cause a cessation of the output data stream corrupting the input data stream. ### Claim 2 (depends on 1) The system of claim 1, comprising two or more low-latency packet monitors each associated with one of two or more data routers, wherein packets of the input data stream comprise an identifier used to load balance between the two or more data routers in addition to underlying data, and wherein the selected subset of the input data stream is selected based at least in part on the identifier. ### Claim 3 (depends on 2) The system of claim 2, wherein the identifier is passed through a hash function to facilitate the load balancing. ### Claim 4 (depends on 2) The system of claim 2, wherein the selected subset of the input data stream is selected based at least in part on presence of a letter, number, or substring in the identifier. ### Claim 5 (depends on 1) The system of claim 1, wherein determining the probability that the output stream comprises a corruption of the input data stream comprises determining that a statistically unlikely lack of variation exists in the output data stream given a predetermined expected variation in the output data stream. ### Claim 6 (depends on 1) The system of claim 1, wherein determining the probability that the output data stream comprises a corruption of the input data stream comprises determining that the particular data router is outputting data at a greater volume or with values at a greater magnitude than volumes or magnitudes observed during a previous period of comparison. ### Claim 7 (depends on 1) The system of claim 1, wherein determining the probability that the output data stream comprises a corruption of the input data stream comprises determining that the output data stream comprised a number of queries during a past time interval and that during a present time interval, a ratio of a number of new queries during the present time interval to a number of received responses to queries from the past time interval is not within a predetermined range. ### Claim 8 (depends on 1) The system of claim 1, wherein transmitting the electronic message to cause the cessation of the output data stream corrupting the input data stream comprises limiting a scope of data transmissions allowed by the particular data router. ### Claim 9 (depends on 1) The system of claim 1, wherein transmitting the electronic message to cause the cessation of the output data stream corrupting the input data stream comprises causing another data router to act on the selected subset of the input data stream instead of the particular data router. ### Claim 10 (depends on 1) The system of claim 1, wherein transmitting the electronic message to cause the cessation of the output data stream corrupting the input data stream comprises causing the particular data router to cease all outgoing transmissions. ### Claim 11 A computer-implemented method for detecting a data router malfunction, comprising: receiving, by a computing device, from a low-latency packet monitor, and over a series of time windows, a copy of an output data stream from a data router that is configured to receive an input data stream and forward a selected subset of the input data stream as its output data stream; inputting, by the computing device and into a long short-term memory (LSTM) neural network, data received from the copy of the output data stream over the series of time windows; determining, by the computing device, after each time window, and using the LSTM neural network, a probability that received data from the present time window represents a corruption of the input data stream due to software failure or hardware failure in the data router; and responsive to determining that the probability exceeds a predetermined threshold, automatically transmitting an electronic message to the data router to modify output of the communications network node and prevent output of data by the data router that is not an accurate copy of data from the input data stream. ### Claim 12 (depends on 11) The method of claim 11, wherein packets of the input data stream comprise an identifier used to load balance between the data router and one or more other data routers in addition to underlying data, and wherein the selected subset of the input data stream is selected based at least in part on the identifier. ### Claim 13 (depends on 12) The method of claim 12, wherein the identifier is passed through a hash function to facilitate the load balancing. ### Claim 14 (depends on 12) The method of claim 12, wherein the selected subset of the input data stream is selected based at least in part on presence of a letter, number, or substring in the identifier. ### Claim 15 (depends on 11) The method of claim 11, wherein determining the probability that received data from the present time window represents a corruption of the input data stream comprises determining that a statistically unlikely lack of variation exists in the output data stream given a predetermined expected variation in the output data stream. ### Claim 16 (depends on 11) The method of claim 11, wherein determining the probability that received data from the present time window represents a corruption of the input data stream comprises determining that the particular data router is outputting data at a greater volume or with values at a greater magnitude than volumes or magnitudes observed during a previous period of comparison. ### Claim 17 (depends on 11) The method of claim 11, wherein determining the probability that received data from the present time window represents a corruption of the input data stream comprises determining that the output data stream comprised a set of queries during a past time interval and that during a present time interval, a ratio of a number of new queries during the present time interval to a number of received responses to queries from the past time interval is not within a predetermined range. ### Claim 18 (depends on 11) The method of claim 11, wherein transmitting the electronic message to modify the output comprises limiting a scope of data transmissions allowed by the data router. ### Claim 19 (depends on 11) The method of claim 11, wherein transmitting the electronic message to modify the output comprises causing another data router to act on the selected subset of the input data stream instead. ### Claim 20 (depends on 11) The method of claim 11, wherein transmitting the electronic message to modify the output comprises causing the data router to cease all outgoing transmissions.