公开(公告)号：US20210281492A1

公开(公告)日：2021-09-09

申请号：US16812517

申请日：2020-03-09

Applicant: Cisco Technology, Inc.

Inventor： Andrea Di Pietro ,  Javier Cruz Mota ,  Sukrit Dasgupta ,  Jean-Philippe Vasseur

IPC: H04L12/24 ,  G06N20/00

Abstract: In one embodiment, a network assurance service that monitors a network detects a network issue in the network using a machine learning model and based on telemetry data captured in the network. The service assigns the detected network issue to an issue cluster by applying clustering to the detected network issue and to a plurality of previously detected network issues. The service selects a set of one or more actions for the detected network issue from among a plurality of actions associated with the previously detected network issues in the issue cluster. The service obtains context data for the detected network issue. The service provides, to a user interface, an indication of the detected network issue, the obtained context data for the detected network issue, and the selected set of one or more actions.

公开(公告)号：US20210279632A1

公开(公告)日：2021-09-09

申请号：US16809060

申请日：2020-03-04

Applicant: Cisco Technology, Inc.

Inventor： Andrea Di Pietro ,  Javier Cruz Mota ,  Sukrit Dasgupta ,  Jean-Philippe Vasseur

IPC: G06N20/00 ,  G06N5/04 ,  H04L12/24

Abstract: In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

公开(公告)号：US10931692B1

公开(公告)日：2021-02-23

申请号：US15001806

申请日：2016-01-20

Applicant: Cisco Technology, Inc.

Inventor： Javier Cruz Mota ,  Jean-Philippe Vasseur ,  Grégory Mermoud ,  Andrea Di Pietro

IPC: G06F11/00 ,  H04L29/06 ,  G06N20/00

Abstract: In one embodiment, a device in a network receives information regarding a network anomaly detected by an anomaly detector deployed in the network. The device identifies the detected network anomaly as a false positive based on the information regarding the network anomaly. The device generates an output filter for the anomaly detector, in response to identifying the detected network anomaly as a false positive. The output filter is configured to filter an output of the anomaly detector associated with the false positive. The device causes the generated output filter to be installed at the anomaly detector.

公开(公告)号：US10917803B2

公开(公告)日：2021-02-09

申请号：US15620109

申请日：2017-06-12

Applicant: Cisco Technology, Inc.

Inventor： Javier Cruz Mota ,  Jean-Philippe Vasseur ,  Pierre-André Savalle ,  Grégory Mermoud

IPC: H04W24/08 ,  H04W24/02 ,  H04W88/08

Abstract: In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.

公开(公告)号：US10673728B2

公开(公告)日：2020-06-02

申请号：US15880689

申请日：2018-01-26

Applicant: Cisco Technology, Inc.

Inventor： Andrea Di Pietro ,  Jean-Philippe Vasseur ,  Javier Cruz Mota ,  Grégory Mermoud

IPC: H04L12/26 ,  H04L12/24

Abstract: In one embodiment, a local service of a network reports configuration information regarding the network to a cloud-based network assurance service. The local service receives a classifier selected by the cloud-based network assurance service based on the configuration information regarding the network. The local service classifies, using the received classifier, telemetry data collected from the network, to select a modeling strategy for the network. The local service installs, based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.

公开(公告)号：US10659333B2

公开(公告)日：2020-05-19

申请号：US15188175

申请日：2016-06-21

Applicant: Cisco Technology, Inc.

Inventor： Laurent Sartran ,  Pierre-André Savalle ,  Jean-Philippe Vasseur ,  Grégory Mermoud ,  Javier Cruz Mota ,  Sébastien Gay

IPC: H04L12/26

Abstract: In one embodiment, a device in a network determines cluster assignments that assign traffic data regarding traffic in the network to activity level clusters based on one or more measures of traffic activity in the traffic data. The device uses the cluster assignments to predict seasonal activity for a particular subset of the traffic in the network. The device determines an activity level for new traffic data regarding the particular subset of traffic in the network. The device detects a network anomaly by comparing the activity level for the new traffic data to the predicted seasonal activity.

公开(公告)号：US10212044B2

公开(公告)日：2019-02-19

申请号：US15466969

申请日：2017-03-23

Applicant: Cisco Technology, Inc.

Inventor： Grégory Mermoud ,  Pierre-André Savalle ,  Jean-Philippe Vasseur ,  Javier Cruz Mota

IPC: G06F15/16 ,  H04L12/24 ,  G06N3/08 ,  G06N3/04 ,  H04L29/06 ,  H04L29/08 ,  H04N7/16

Abstract: In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors. The device provides a label for the particular state vector to a user interface. The label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors.

公开(公告)号：US10200404B2

公开(公告)日：2019-02-05

申请号：US15863257

申请日：2018-01-05

Applicant: Cisco Technology, Inc.

Inventor： Javier Cruz Mota ,  Jean-Philippe Vasseur ,  Andrea Di Pietro

IPC: H04L29/06

Abstract: In one embodiment, a traffic model manager node receives data flows in a network and determines a degree to which the received data flows conform to one or more traffic models classifying particular types of data flows as non-malicious. If the degree to which the received data flows conform to the one or more traffic models is sufficient, the traffic model manager node characterizes the received data flows as non-malicious. Otherwise, the traffic model manager node provides the received data flows to a denial of service (DoS) attack detector in the network to allow the received data flows to be scanned for potential attacks.

公开(公告)号：US20180359651A1

公开(公告)日：2018-12-13

申请号：US15620109

申请日：2017-06-12

Applicant: Cisco Technology, Inc.

Inventor： Javier Cruz Mota ,  Jean-Philippe Vasseur ,  Pierre-André Savalle ,  Grégory Mermoud

IPC: H04W24/08

CPC classification number: H04W24/08 ,  H04W88/08

Abstract: In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.

公开(公告)号：US20180204129A1

公开(公告)日：2018-07-19

申请号：US15405455

申请日：2017-01-13

Applicant: Cisco Technology, Inc.

Inventor： Jean-Philippe Vasseur ,  Grégory Mermoud ,  Pierre-André Savalle ,  Javier Cruz Mota

IPC: G06N7/00 ,  H04L29/06 ,  H04L12/24 ,  G06N99/00

CPC classification number: G06N7/005 ,  G06N20/00 ,  H04L12/1818 ,  H04L12/1822 ,  H04L12/1827 ,  H04L41/147 ,  H04L65/1003 ,  H04L65/403 ,  H04W84/12

Abstract: In one embodiment, a device in a network receives an indication of a connection between an endpoint node in the network and a conferencing service. The device retrieves network data associated with the indicated connection between the endpoint node and the conferencing service. The device uses a machine learning model to predict an experience metric for the endpoint node based on the network data associated with the indicated connection between the endpoint node and the conferencing service. The device causes the endpoint node to use a different connection to the conferencing service based on the predicted experience metric.