Cisco Technology, Inc.

Dmitri Goloubev

Donald Mark Allen

Carlos M Pignataro

Hugo Latapie

David Delano Ward

Gonzalo A Salgueiro

Joseph Michael Clarke

Enzo Fenoglio

Sawsen Rezig

Luc De Ghein

Volodymyr Iashyn

Nassim Benoussaid

Raphaël Wouters

Borys Viacheslavovych Berlog

Didier Colens

Charles Calvin Byers

M David Hanes

Peter De Vriendt

Matthew Henry Birkner

Presented herein are techniques to analyze network traffic and equipment based on telemetry generated by a plurality of network devices. A method includes generating first telemetry at a first network device, receiving, at the first network device, via an Internet Protocol anycast addressing scheme, at least one of second telemetry generated at a second network device, and third telemetry generated at a third network device, performing, on the first network device using a local processing unit, first analytics on the first telemetry, performing, on the first network device using the local processing unit, second analytics on the at least one of the second telemetry and the third telemetry, and transmitting data resulting from the first analytics and the second analytics to a fourth network device.

Distributed virtualization of telemetry processing with IP anycast

A method includes associating anomalous first text, from a first unstructured data set, with a first classification; processing the first unstructured data set using at least one of ML or AI to identify a second text that is in close context to the first text, and adding the second text to a text list associated with the first classification; enriching the text list by processing the second text to generate a third text, and adding the third text to the text list to produce an enriched text list and such that the third text is also associated with the first classification; matching the text in the enriched text list to text in a second unstructured data set; and classifying the text in the second unstructured data set as having the first classification when the text in the second unstructured data set matches text in the enriched text list.

Anomaly classification with attendant word enrichment

In one embodiment, a service that monitors a network detects a plurality of anomalies in the network. The service uses data regarding the detected anomalies as input to one or more machine learning models. The service maps, using a conceptual space, outputs of the one or more machine learning models to symbols. The service applies a symbolic reasoning engine to the symbols, to rank the anomalies. The service sends an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.

Deep fusion reasoning engine (DFRE) for prioritizing network monitoring alerts

A digitized Intellectual Capital (IC) system obtains code modules configured to detect one or more issues in a computing system. The IC system selects from the code modules to generate a first set of code modules based on a corresponding value metric. The corresponding value metric for each code module in the first set of code modules is higher than a predetermined threshold. The IC system also samples from the remainder of the code modules unselected for the first set of code modules to generate a second set of code modules. The IC system runs the first set of code modules and the second set of code modules to detect the one or more issues and updates the corresponding value metric for at least one code module.

Predicting the efficacy of issues detected with machine executed digitized intellectual capital

Presented herein are methodologies to on-board and monitor Internet of Things (IoT) devices on a network. The methodology includes receiving at a server, from a plurality of IoT devices communicating over a network, data representative of external environmental factors being experienced by individual ones of the plurality of IoT devices at a predetermined location; generating, using machine learning, an aggregated model of the external environmental factors at the predetermined location; receiving, at the server, a communication indicative that a new IoT device seeks to join the network at the predetermined location; receiving, from the new IoT device, data representative of external environmental factors being experienced by the new IoT device; determining whether there is a discrepancy between the external environmental factors of the new IoT device and the aggregated model; and when there is such a discrepancy, prohibiting the new IoT device from joining the network.

Sensor fusion for trustworthy device identification and monitoring

Presented herein are techniques to analyze network anomaly signals based on both a spatial component and a temporal component. A method includes identifying a plurality of factors that trigger a first anomaly signal by a first network node and a second anomaly signal by a second network node in a network comprising a plurality of network nodes, determining that the first network node is adjacent to the second network node in the plurality of network nodes, calculating an anomaly severity score for the first network node based on a number of co-occurring factors from among the plurality of factors that trigger both the first anomaly signal and the second anomaly signal, and adjusting the anomaly severity score for the first network node based on a value of a prior anomaly severity score for the first network node.

Spatio-temporal event weight estimation for network-level and topology-level representations

Systems, methods, and computer-readable media for distributing machine learning. In some examples, a first GAN model is deployed to a first network edge device and a second GAN model is deployed to a second network edge device. A generator of the first GAN model can be trained using real telemetry data of a first computing node and a generator of the second GAN model can be trained using real telemetry data of a second IoT device. The generator of the first GAN model and the generator of the second GAN model can be received. Additionally, a unified generator of a unified GAN model can be trained using the generator of the first GAN model and the generator of the second GAN model. Subsequently, the unified GAN model can be deployed to a third computing node for monitoring operation of the third IoT device.

Knowledge aggregation for GAN-based anomaly detectors

Presented herein are techniques for obtaining pertinent information from a network upon detection of an anomaly by receiving, at a first network node, configuration information sufficient to establish a data collection policy for the network node, capturing data, on the first network node, in accordance with the data collection policy to obtain captured data, detecting an anomaly occurring with respect to a second network node, and in response to detecting the anomaly, in transferring from the first network node, to an analysis server, collected data derived from the captured data based on both the data collection policy and a proximity metric indicating a logical distance between the first network node and the second network node.

Growing community of inventors

Waterloo, Belgium

Dmitri Goloubev