# US 2021/0243210 A1 · Online Anomaly Detection of Vector Embeddings > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243210 A1 - Document ID: US20210243210A1 - Status: Published application - Kind: A1 - Application number: 16/778,585 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Extreme Networks, Inc. - Applicants: Extreme Networks, Inc. - Inventors: Giacomo BERNARDI; Donagh HORGAN; Jeffrey W. HASKELL; Markus NISPEL - Web page: https://patentgrep.com/patent/US20210243210A1 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed herein are system, method, and computer program product embodiments for providing an anomaly detection system. Some aspects of this disclosure include a method for detecting anomaly in a network device. The method includes determining one or more similarity values between a flow vector corresponding to a flow associated with the network device and one or more flow clusters associated with the network device. The method further includes determining a maximum similarity value as a maximum of the one or more similarity values and comparing the maximum similarity value to a threshold. The method also includes, in response to the maximum similarity value being equal to or greater than the threshold, updating a flow cluster associated with the maximum similarity value. The method also includes, in response to the maximum similarity measure being less than the threshold, detecting the anomaly in the network device. ## Claims ### Claim 1 A method for detecting an anomaly in a network device, the method comprising: receiving a flow vector corresponding to a flow associated with the network device; determining one or more similarity values between the flow vector and one or more flow clusters associated with the network device; determining a maximum similarity value as a maximum of the one or more similarity values; comparing the maximum similarity value to a threshold; in response to the maximum similarity value being equal to or greater than the threshold, updating a flow cluster associated with the maximum similarity value; and in response to the maximum similarity measure being less than the threshold, detecting the anomaly in the network device. ### Claim 2 (depends on 1) The method of claim 1, wherein the updating the flow cluster associated with the maximum similarity value comprises: determining an exponentially weighted moving average between the flow vector and the flow cluster associated with the maximum similarity value; and updating a timestamp associated with the flow cluster associated with the maximum similarity value, wherein the updated timestamp indicates a time that the flow cluster associated with the maximum similarity value is updated. ### Claim 3 (depends on 1) The method of claim 1, wherein the detecting the anomaly in the network device comprises: generating a new flow cluster based on the flow vector; and associating a timestamp with the new flow cluster, the timestamp indicating a time that the new flow cluster is generated. ### Claim 4 (depends on 1) The method of claim 1, wherein the determining the one or more similarity values comprises applying a cosine similarity measure to the one or more similarity values. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving a first initial flow vector corresponding to a first flow associated with the network device; receiving a second initial flow vector corresponding to a second flow associated with the network device; determining a similarity value between the first initial flow vector and the second initial flow vector; comparing the similarity value to a similarity threshold; and in response to the similarity value being equal to or greater than the similarity threshold, generating the flow vector. ### Claim 6 (depends on 5) The method of claim 5, wherein the generating the flow vector comprises creating a weighted average of the first initial flow vector and the second initial flow vector. ### Claim 7 (depends on 5) The method of claim 5, wherein the first and second initial flow vectors are stored in contiguous memory spaces. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving the threshold used for detecting the anomaly in the network device. ### Claim 9 (depends on 1) The method of claim 1, further comprising: dynamically updating the threshold based on at least one of the flow associated with the network device or a behavior of the network device. ### Claim 10 A method, comprising: receiving a network flow associated with a network device; comparing the network flow to one or more flow clusters associated with the network device; and determining, based on the comparing and at a flow level, whether the network flow indicates an anomaly in a behavior of the network device. ### Claim 11 (depends on 10) The method of claim 10, further comprising: in response to determining that the network flow indicates the anomaly in the behavior of the network device: updating one of the one or more flow clusters: updating a timestamp associated with the updated flow cluster, wherein the updated timestamp indicates a time that the one of the one or more flow clusters is updated. ### Claim 12 (depends on 10) The method of claim 10, further comprising: in response to determining that the network flow does not indicate the anomaly in the behavior of the network device: generating a new flow cluster based on the received network flow; and associating a timestamp with the new flow cluster, the timestamp indicating a time that the new flow cluster is generated. ### Claim 13 A system, comprising: a memory; and at least one processor coupled to the memory and configured to: determine one or more similarity values between a flow vector corresponding to a flow associated with a network device and one or more flow clusters associated with the network device; determine a maximum similarity value as a maximum of the one or more similarity values; compare the maximum similarity value to a threshold; in response to the maximum similarity value being equal to or greater than the threshold, update a flow cluster associated with the maximum similarity value; and in response to the maximum similarity measure being less than the threshold, detect an anomaly in the network device and generate an alert message based on the detected anomaly. ### Claim 14 (depends on 13) The system of claim 13, wherein to update the flow cluster associated with the maximum similarity value, the at least one processor is configured to: determine an exponentially weighted moving average between the flow vector and the flow cluster associated with the maximum similarity value; and update a timestamp associated with the flow duster associated with the maximum similarity value, wherein the updated timestamp indicates a time that the flow cluster associated with the maximum similarity value is updated. ### Claim 15 (depends on 13) The system of claim 13, wherein to detect the anomaly in the behavior of the network device, the at least one processor is configured to: generate a new flow cluster based on the flow vector; and associate a timestamp with the new flow cluster, the timestamp indicating a time that the new flow cluster is generated. ### Claim 16 (depends on 13) The system of claim 13, wherein the at least one processor is further configured to dynamically update the threshold based on at least one of the flow associated with the network device or a behavior of the network device. ### Claim 17 (depends on 13) The system of claim 13, wherein to determine the one or more similarity values, the at least one processor is configured to apply a cosine similarity measure to the one or more similarity, values. ### Claim 18 (depends on 13) The system of claim 13, wherein the at least one processor is further configured to dynamically update the threshold based on the flow associated with the network device. ### Claim 19 (depends on 13) The system of claim 13, wherein the at least one processor is further configured to: receive a first initial flow vector corresponding to a first flow associated with the network device; receive a second initial flow vector corresponding to a second flow associated with the network device; determine a similarity value between the first initial flow vector and the second initial flow vector; compare the similarity value to a similarity threshold; and in response to the similarity value being equal to or greater than the similarity threshold, generate the flow vector. ### Claim 20 (depends on 19) The system of claim 19, wherein to generate the flow vector, the at least one processor is configured to create a weighted average of the first initial flow vector and the second initial flow vector.