# US 9,870,537 B2 · Distributed learning in a computer network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,870,537 B2 - Document ID: US9870537B2 - Status: Granted - Kind: B2 - Application number: 14/164,446 - Filed: 2014-01-27 - Published: 2015-07-09 - Granted: 2018-01-16 - Earliest claimed: 2014-01-06 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Jean-Philippe Vasseur; Javier Cruz Mota; Andrea Di Pietro - Web page: https://patentgrep.com/patent/US9870537B2 ## CPC - G06N 20/00: Machine learning - G06N 3/045: Combinations of networks - G06N 3/0499: Feedforward networks - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 3/098: Distributed learning, e.g. federated learning - H04L 41/142: using statistical or mathematical methods - H04L 41/16: using machine learning or artificial intelligence - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a first data set is received by a network device that is indicative of the statuses of a plurality of network devices when a type of network attack is not present. A second data set is also received that is indicative of the statuses of the plurality of network devices when the type of network attack is present. At least one of the plurality simulates the type of network attack by operating as an attacking node. A machine learning model is trained using the first and second data set to identify the type of network attack. A real network attack is then identified using the trained machine learning model. ## Claims ### Claim 1 A method comprising: sending, by a network device, a request to a network policy engine to initiate collection of a first or a second data set from a plurality of network devices, the first data set indicative of the statuses of the plurality of network devices when a type of network attack is not present and the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present; receiving, at the network device, an authorization from the network policy engine to begin collection of the first or second data set, the authorization based on an evaluation of an impact of collecting the first or second data sets on network traffic; in response to receiving the authorization from the network policy engine, receiving, at the network device, the first data set indicative of the statuses of the plurality of network devices when the type of network attack is not present; selecting, by the network device, at least one of the plurality of network devices to simulate the type of network attack by operating as an attacking node; and receiving, at the network device, the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present based on the at least one of the plurality of network devices selected to simulate the type of network attack by operating as an attacking node; training a machine learning model using the first and second data set to identify the type of network attack; and identifying a real network attack using the trained machine learning model. ### Claim 2 (depends on 1) The method as in claim 1, wherein the machine learning model is an artificial neural network (ANN). ### Claim 3 (depends on 1) The method as in claim 1, further comprising: requesting the first or second data set from the plurality of network devices, in response to receiving the authorization to begin collection of the first or second data set. ### Claim 4 (depends on 1) The method as in claim 1, wherein the authorization comprises a scheduled start time for the collection of a simulated attack type, wherein the first or second data set is requested at the start time. ### Claim 5 (depends on 1) The method as in claim 1, wherein the request to initiate collection of the first or second data set comprises data selected from the group comprising: an estimated time duration for the data collection and an estimated size of the first or second data set. ### Claim 6 (depends on 1) The method as in claim 1, wherein the authorization comprises an instruction to reduce an estimated duration for the collection of the first or second data set. ### Claim 7 (depends on 1) The method as in claim 1, further comprising: sending an instruction to the at least one of the plurality of network devices to simulate the type of network attack. ### Claim 8 (depends on 1) The method as in claim 1, wherein the at least one of the plurality of network devices that simulates the type of network attack is selected randomly. ### Claim 9 (depends on 1) The method as in claim 1, further comprising: notifying the network policy engine that the machine learning model has been trained. ### Claim 10 (depends on 1) The method as in claim 1, further comprising: notifying a network policy engine of the network attack identified using the machine learning model. ### Claim 11 An apparatus, comprising: one or more network interfaces to communicate in a computer network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: send a request to a network policy engine to initiate collection of a first or a second data set from a plurality of network devices, the first data set indicative of the statuses of the plurality of network devices when a type of network attack is not present and the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present; receive an authorization from the network policy engine to begin collection of the first or second data set, the authorization based on an evaluation of an impact of collecting the first or second data set on network traffic; in response to receiving the authorization from the network policy engine, receive the first data set indicative of the statuses of the plurality of network devices when the type of network attack is not present; select at least one of the plurality of network devices to simulate the type of network attack by operating as an attacking node; and receive the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present based on the at least one of the plurality of network devices selected to simulate the type of network attack by operating as an attacking node; train a machine learning model using the first and second data set to identify the type of network attack; and identify a real network attack using the trained machine learning model. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the machine learning model is an artificial neural network (ANN). ### Claim 13 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further operable to: send an instruction to the at least one of the plurality of network devices to simulate the type of network attack. ### Claim 14 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further operable to: request the first or second data set from the plurality of network devices, in response to receiving the authorization to begin collection of the first or second data set. ### Claim 15 (depends on 11) The apparatus as in claim 11, wherein the authorization comprises a scheduled start time for the collection, and wherein the first or second data set is requested at the start time. ### Claim 16 A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to: send a request to a network policy engine to initiate collection of a first or a second data set from a plurality of network devices, the first data set indicative of the statuses of the plurality of network devices when a type of network attack is not present and the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present; receive an authorization from the network policy engine to begin collection of the first or second data set, the authorization based on an evaluation of an impact of collecting the first or second data sets on network traffic; in response to receiving the authorization from the network policy engine, receive the first data set indicative of the statuses of the plurality of network devices when the type of network attack is not present; select at least one of the plurality of network devices to simulate the type of network attack by operating as an attacking node; receive the second data set indicative of the statuses of the plurality of network devices when the type of network attack is present based on the at least one of the plurality of network devices selected to simulate the type of network attack by operating as an attacking node; train a machine learning model using the first and second data set to identify the type of network attack; and identify a real network attack using the trained machine learning model. ### Claim 17 (depends on 16) The computer-readable media as in claim 16, wherein the machine learning model is an artificial neural network (ANN).