Deriving highly interpretable cognitive patterns for network assurance

    公开(公告)号:US11049033B2

    公开(公告)日:2021-06-29

    申请号:US15869639

    申请日:2018-01-12

    Abstract: In one embodiment, a network assurance system that monitors a network labels time periods with positive labels, based on the network assurance system detecting problems in the network during the time periods. The network assurance system assigns tags to discrete portions of a feature space of measurements from the monitored network, based on whether a particular range of values in the feature space has a threshold probability of occurring during a positively-labeled time period. The network assurance system determines a set of the assigned tags that frequently co-occur with the positively-labeled time periods in which problems are detected in the network. The network assurance system causes performance of a mitigation action in the network based on the set of assigned tags that frequently co-occur with the positively-labeled time periods.

    DETECTING NETWORK ENTITY GROUPS WITH ABNORMAL TIME EVOLVING BEHAVIOR

    公开(公告)号:US20200092172A1

    公开(公告)日:2020-03-19

    申请号:US16132933

    申请日:2018-09-17

    Abstract: In one embodiment, a network assurance service that monitors a network calculates network frequency distributions of a performance measurement from the network over a plurality of different time periods. The service calculates entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods. The service determines distance measurements between the network frequency distributions and the entity frequency distributions. The service identifies a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping. The service provides an indication of the identified outlier grouping to a user interface.

    Integrating rule based systems with distributed data processing by pushing control to edge agents

    公开(公告)号:US09727819B2

    公开(公告)日:2017-08-08

    申请号:US14563111

    申请日:2014-12-08

    CPC classification number: G06N5/025 G06F17/30395 G06F17/30557

    Abstract: In an embodiment, an improved computer-implemented method of efficiently determining actions to perform based on data from a streaming continuous queries in a distributed computer system comprises, at a central control computer, receiving a streaming continuous query and a rule-set; wherein the rule-set comprises decision data representing decisions based on attributes produced by the query, and action data representing end actions based on the decisions, wherein the attributes comprise data processed by one or more networked computers; separating the streaming continuous query into a sub-query executable at one or more edge computers; categorizing end actions from the set based on decisions requiring attributes available from the sub-query into a set of one or more edge expressions that are configured to be evaluated at an edge agent to cause an action; providing the set of edge expressions and the sub-query to at least one edge computer with instructions to process visible attributes on the edge computer and to evaluate the set of one or more edge expressions independently from the central control computer; wherein the method is performed by one or more computing devices.

    LEVERAGING LOCATION DATA FROM MOBILE DEVICES FOR USER CLASSIFICATION

    公开(公告)号:US20170105099A1

    公开(公告)日:2017-04-13

    申请号:US14881538

    申请日:2015-10-13

    CPC classification number: H04W4/30 H04L67/22 H04W4/04

    Abstract: Location data is obtained from signals transmitted by a first plurality of mobile wireless devices in a wireless network, wherein the first plurality of mobile wireless devices are moving within a predefined space, and wherein the location data comprises a plurality of location data time points, each location data time point including a timestamp, a unique mobile wireless device identifier, and location information indicating where in the predefined space an associated mobile wireless device is located. For each mobile wireless device, location data time points are aggregated to generate a set of aggregated location data for each mobile wireless device, and the set of aggregated location data is analyzed to determine characteristics corresponding to time-dependent behavior and location-specific behavior of the corresponding mobile wireless device. A user of each corresponding mobile wireless device is classified into a category of a plurality of categories based on the determined characteristics.

    METHOD AND APPARATUS FOR MANAGING INTERRUPTIONS FROM DIFFERENT MODES OF COMMUNICATION
    16.
    发明申请
    METHOD AND APPARATUS FOR MANAGING INTERRUPTIONS FROM DIFFERENT MODES OF COMMUNICATION 有权
    用于管理来自不同通信模式的中断的方法和装置

    公开(公告)号:US20150094032A1

    公开(公告)日:2015-04-02

    申请号:US14563224

    申请日:2014-12-08

    Abstract: Methods and apparatus for managing interruptions in a multiple communication mode environment are provided herein. For example, a method may include receiving at least first instance of communication data associated with a first communication mode; obtaining first attribute data related to the first instance of communication data; classifying the first instance of communication data into first category based on the first attribute data using the interruption management device; and determining whether to interrupt a user by delivering the first instance of communication data based on the first category. The first category may be selected from a plurality of predetermined categories using a classification algorithm.

    Abstract translation: 本文提供了用于管理多通信模式环境中的中断的方法和装置。 例如,一种方法可以包括:接收与第一通信模式相关联的通信数据的至少第一实例; 获取与第一通信数据相关的第一属性数据; 基于使用中断管理装置的第一属性数据将通信数据的第一实例分类为第一类别; 以及通过基于所述第一类别传递所述通信数据的第一实例来确定是否中断用户。 可以使用分类算法从多个预定类别中选择第一类别。

    DETECTING NETWORK INTRUSION AND ANOMALY INCIDENTS
    17.
    发明申请
    DETECTING NETWORK INTRUSION AND ANOMALY INCIDENTS 审中-公开
    检测网络侵扰和异常事件

    公开(公告)号:US20140230062A1

    公开(公告)日:2014-08-14

    申请号:US13962863

    申请日:2013-08-08

    Inventor: Vikram Kumaran

    CPC classification number: H04L63/1408 G06F21/554

    Abstract: In an embodiment, a method comprises: using computing apparatus, receiving one or more data streams, determining one or more characteristics of the one or more data streams, and based on the one or more characteristics of the one or more data streams, determining one or more tags for the one or more data streams; determining whether the one or more tags indicate one or more malicious patterns representative of network intrusions; in response to determining that the one or more tags indicate one or more malicious patterns representative of network intrusions: generating, based on the one or more tags, one or more aggregated alert streams; applying one or more rules to the one or more aggregated alert streams and receiving a result indicating whether a network intrusion is in progress; in response thereto, determining and executing one or more remedial actions.

    Abstract translation: 在一个实施例中,一种方法包括:使用计算装置,接收一个或多个数据流,确定所述一个或多个数据流的一个或多个特性,并且基于所述一个或多个数据流的一个或多个特性,确定一个 或更多的标签; 确定所述一个或多个标签是否指示代表网络入侵的一个或多个恶意模式; 响应于确定所述一个或多个标签指示表示网络入侵的一个或多个恶意模式:基于所述一个或多个标签生成一个或多个聚合警报流; 将一个或多个规则应用于所述一个或多个聚合警报流并接收指示网络入侵是否正在进行的结果; 响应于此,确定并执行一个或多个补救动作。

    Data anonymization for distributed hierarchical networks

    公开(公告)号:US10778647B2

    公开(公告)日:2020-09-15

    申请号:US15185380

    申请日:2016-06-17

    Inventor: Vikram Kumaran

    Abstract: Various implementations disclosed herein provide a method for anonymizing data in a distributed hierarchical network. In various implementations, the method includes determining a first set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes that are stored at the first network node and have not been transmitted upstream towards the hub. In various implementations, the method includes receiving, from a second network node, a second set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes at the second network node. In various implementations, the method includes determining whether a sum based on the first and second set of attribute hierarchy counts satisfies an anonymization criterion. In some implementations, the sum indicates a total number of occurrences for a corresponding attribute that are stored at the first and second network nodes and have not been transmitted upstream towards the hub.

    DETECTING TRANSIENT VS. PERPETUAL NETWORK BEHAVIORAL PATTERNS USING MACHINE LEARNING

    公开(公告)号:US20190238421A1

    公开(公告)日:2019-08-01

    申请号:US15880600

    申请日:2018-01-26

    Abstract: In one embodiment, a network assurance service that monitors a network detects a pattern of network measurements from the network that are associated with a particular network problem. The network assurance service tracks characteristics of the detected pattern over time. The network assurance service uses the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer. The pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern. The network assurance service initiates a change to the network based on an output of the machine learning-based pattern analyzer.

Patent Agency Ranking