Network anomaly detection and mitigation
AssigneeJuniper Networks, Inc.
InventorEbrahim Safavi
Life of this patent
Estimating the term…
Abstract
A network management system may detect congestion and other network problems, identify the root cause of the issue and invoke remedial actions. The network management system may collect a time series of network data from various devices in the network. The network management system may use the collected network data to determine metrics indicating whether the network is experiencing congestion and/or anomalies, and if so, what is the root cause. Once the root cause is identified an automated and/or manual corrective action may take place.
Claims20
A method comprising:
- receiving, at a computing device from a plurality of network devices in a network, network data collected by the plurality of network devices;
- determining, from the network data, a time series of statistics for each of the plurality of network devices;
- aggregating, at the computing device, the time series of statistics for each of the plurality of network devices to produce an aggregated time series of statistics;
- detecting, at the computing device, an anomaly in the network based on the aggregated time series of statistics, the anomaly having an associated anomaly time period;
- and
- determining, at the computing device, that a first network device of the plurality of network devices is related to the anomaly using a temporal method that uses curves of statistics within the associated anomaly time period to determine that a curve of the time series of statistics for the first network device is more correlated to a curve of the aggregated time series of statistics than curves of the time series of statistics for other network devices of the plurality of network devices within the associated anomaly time period.
(canceled)
(canceled)
A computing device comprising:
- a memory;
- and
- one or more processors coupled to the memory and configured to:
- receive, from a plurality of network devices in a network, network data collected by the plurality of network devices,
- determine, from the network data, a time series of statistics for each of the plurality of network devices,
- aggregate the time series of statistics for each of the plurality of network devices to produce an aggregated time series of statistics,
- detect an anomaly within the network based on the aggregated time series of statistics, the anomaly having an associated anomaly time period, and
- determine that a first network device of the plurality of network devices is related to the anomaly using a temporal method that uses curves of statistics within the associated anomaly time period to determine that a curve of the time series of statistics for the first network device is more correlated to a curve of the aggregated time series of statistics than curves of the time series of statistics for other network devices of the plurality of network devices within the associated anomaly time period.
(canceled)
(canceled)
A non-transitory computer-readable storage medium having instructions stored thereon that, when executed, cause one or more processors to:
- receive from a plurality of network devices in a network, network data collected by the plurality of network devices,
- determine, from the network data, a time series of statistics for each of the plurality of network devices,
- aggregate the statistics for each of the plurality of network devices to produce an aggregated time series of statistics,
- detect an anomaly within the network based on the aggregated time series of statistics, the anomaly having an associated anomaly time period, and
- determine that a first network device of the plurality of network devices is related to the anomaly using a temporal method that uses curves of statistics within the associated anomaly time period to determine that a curve of the time series of statistics for the first network device is more correlated to a curve of the aggregated time series of statistics than curves of the time series of statistics for other network devices of the plurality of network devices within the associated anomaly time period.
Dependencies are inferred from the claim text.