公开(公告)号：US20150193696A1

公开(公告)日：2015-07-09

申请号：US14164460

申请日：2014-01-27

Applicant: Cisco Technology, Inc.

Inventor： Jean-Philippe Vasseur ,  Javier Cruz Mota ,  Andrea Di Pietro

IPC: G06N99/00 ,  H04L12/26

CPC classification number: H04L63/1425 ,  G06N3/02 ,  G06N3/08 ,  G06N3/084 ,  G06N99/005 ,  H04L41/16 ,  H04L43/0876 ,  H04L45/48 ,  H04L47/127 ,  H04L47/2466 ,  H04L47/41

Abstract: In one embodiment, network data is received at a first node in a computer network. A low precision machine learning model is used on the network data to detect a network event. A notification is then sent to a second node in the computer network that the network event was detected, to cause the second node to use a high precision machine learning model to validate the detected network event.

Abstract translation: 在一个实施例中，在计算机网络中的第一节点处接收网络数据。 网络数据采用低精度机器学习模型来检测网络事件。 然后将通知发送到计算机网络中检测到网络事件的第二节点，以使第二节点使用高精度机器学习模型来验证检测到的网络事件。

公开(公告)号：US20150188935A1

公开(公告)日：2015-07-02

申请号：US14165424

申请日：2014-01-27

Applicant: Cisco Technology, Inc.

Inventor： Jean-Philippe Vasseur ,  Javier Cruz Mota ,  Andrea Di Pietro ,  Jonathan W. Hui

IPC: H04L29/06 ,  G06N99/00

CPC classification number: H04L63/1416 ,  G06N99/005 ,  H04K3/226 ,  H04K2203/18 ,  H04L63/1441 ,  H04L63/1458 ,  H04W12/12

Abstract: In one embodiment, techniques are shown and described relating to attack mitigation using learning machines. A node may receive network traffic data for a computer network, and then predict a probability that one or more nodes are under attack based on the network traffic data. The node may then decide to mitigate a predicted attack by instructing nodes to forward network traffic on an alternative route without altering an existing routing topology of the computer network to reroute network communication around the one or more nodes under attack, and in response, the node may communicate an attack notification message to the one or more nodes under attack.

Abstract translation: 在一个实施例中，与使用学习机器的攻击缓解有关的技术被示出和描述。 节点可以接收计算机网络的网络流量数据，然后基于网络流量数据预测一个或多个节点受到攻击的概率。 然后，节点可以通过指示节点在替代路由上转发网络流量而不改变计算机网络的现有路由拓扑以重新路由在被攻击的一个或多个节点周围的网络通信，并且响应于节点 可以将攻击通知消息传送给被攻击的一个或多个节点。