Cisco Technology, Inc.

Anwin P Kallumpurath

Rajiv Asati

Om Prakash Suthar

Embodiments provide for assuring policy based alerting, via clustering, via a first neural network, operational data reported from a network into a plurality of anomalies organized into several clusters; correlating, via the first neural network, alerts received from devices in the network according to the several clusters; determining, via the second neural network, anomaly impacts in the several clusters from the filtered alerts; in response to determining that the anomaly impacts for a first cluster exceed an alerting threshold: identifying a first shared node in the first cluster; identifying a second cluster including a second shared node matching the first shared node that has not been determined to exceed the alerting threshold; and transmitting an alert for the first cluster and the second cluster; and in response to receiving a response to the alert, updating, via the second neural network, the first neural network.

Assurance of policy based alerting

Techniques for adaptive thresholding are provided. A first data point in a data stream is received, and a first plurality of data points from the data stream is identified, where the first plurality of data points corresponds to a timestamp associated with the first data point. At least a first cluster is generated for the first plurality of data points, and a predicted value for the first data point is generated based at least in part on data points in the first cluster. A deviation is computed between the predicted value for the first data point and an actual value for the first data point. Upon determining that the deviation exceeds a first predefined threshold, the first data point is labeled as anomalous, and reallocation of computing resources is facilitated based on labeling the first data point as anomalous.

Multi-domain service assurance using real-time adaptive thresholds

Techniques for adaptive thresholding are provided. First and second data points are received. A plurality of data points are identified, where the plurality of data points corresponds to timestamps associated with the first and second data points. At least one cluster is generated for the plurality of data points based on a predefined cluster radius. Upon determining that the first data point is outside of the cluster, the first data point is labeled as anomalous. A predicted value is generated for the second data point, based on processing data points in the cluster using a machine learning model, and a deviation between the predicted value and an actual value for the second data point is computed. Upon determining that the deviation exceeds a threshold, the second data point is labeled as anomalous. Finally, computing resources are reallocated, based on at least one of the anomalous data points.

Growing community of inventors

Shrewsbury, MA, United States of America

Anwin P Kallumpurath