Cisco Technology, Inc.

Hugo Latapie

Enzo Fenoglio

Joseph T Friel

Andre Surcouf

David Delano Ward

Manikandan Kesavan

Sawsen Rezig

Pascal Thubert

Carlos M Pignataro

Plamen Nedeltchev

Guillaume Sauvage De Saint Marc

Andre Jean-Marie Surcouf

Pete Rai

Dmitri Goloubev

Thierry Gruszka

Franck Bachet

Jean-Philippe Vasseur

Nagendra Kumar Nainar

Santosh Ghanshyam Pandey

Keith Griffin

Paul G Bright-Thomas

Eric Chen

Donald Mark Allen

Ronnie Dan

Ramana Rao V R Kompella

Kenneth Gray

Raphaël Wouters

Nathan Buckles

Didier Colens

Carole Gridley

Ozkan Kilic

David A McGrew

Gonzalo A Salgueiro

Blake Harrell Anderson

Toerless Eckert

Yoann Desmouceaux

Pierre Pfister

Monique Jeanne Morrow

Xu Zhang

Abhishek Mukherji

W Mark Townsley

Huy Phuong Tran

Altan John Stalker

Luc De Ghein

Michael B Costello

Jérôme Tollet

Deon J Chatterton

Dmitry Goloubew

Nassim Benoussaid

Pallavi Kalapatapu

Nham Van Le

Victor Tsekay To

Myungjin Lee

Feng Jiang

Syed Muhammad Mohsin Kazmi

Gaowen Liu

Simon Matthew Young

In one aspect, a method for enhancing cybersecurity using Large Language Model (LLM)-generated honeypot schemes, the method includes generating a plurality of deceptive information using an LLM, configured to attract and engage potential attackers, where the plurality of deceptive information includes one or more characteristics referencing vulnerabilities of a network, continuously monitoring for interactions initiated by an interacting party with one or more components of the generated deceptive information, where the interaction is identified as a potential threat to the network, in response to detection of an interaction identified as a potential threat, extracting interaction data associated with the interacting party retrieved during the interaction, and retraining the LLM with the interaction data to create more effective honeypots.

Method for using generative large language models (LLM) for cybersecurity deception and honeypots

In one embodiment, a device maintains a metamodel that describes a monitored system. The metamodel comprises a plurality of layers ranging from a sub-symbolic space to a symbolic space. The device tracks updates to the metamodel over time. The device updates the metamodel based in part on sub-symbolic time series data generated by the monitored system. The device receives, from a learning agent, a request for the updates to a particular layer of the metamodel associated with a specified time period. The device provides, to the learning agent, data indicative of one or more updates to the particular layer of the metamodel associated with the specified time period.

Cognitive automation for networking, security, IoT, and collaboration

In one embodiment, a first deep fusion reasoning engine (DFRE) agent in a network receives first sensor data from a first set of one or more sensors in the network. The first DFRE agent translates the first sensor data into symbolic data. The first DFRE agent applies, using a symbolic knowledge base maintained by the first DFRE agent, symbolic reasoning to the symbolic data to make an inference regarding the first sensor data. The first DFRE agent updates, based on the inference regarding the first sensor data, the knowledge base. The first DFRE agent propagates the inference to one or more other DFRE agents in the network.

Federated artificial intelligence with cumulative learning in a computer network

In one embodiment, a video analysis service receives video data captured by one or more cameras at a particular location. The service applies a neural network-based model to portions of the video data, to identify objects within the video data. The service maps outputs of the neural network-based model to symbols using a conceptual space. The outputs of the model comprise the identified objects. The service applies a symbolic reasoning engine to the symbols, to generate an alert. The service sends the alert to a user interface in conjunction with the video data.

Video analysis using a deep fusion reasoning engine (DFRE)

In one embodiment, a device obtains data models and workflow logic for a visual programming environment. The device constructs, based on the data models and workflow logic for the visual programming environment, a metamodel that comprises a knowledge graph. The device makes, using the metamodel, an evaluation of an interaction between a user and the visual programming environment. The device provides, based on the evaluation, visualization data to a user interface of the visual programming environment.

Collaborative visual programming environment with cumulative learning using a deep fusion reasoning engine

In one embodiment, a deep fusion reasoning engine receives network telemetry data collected from a network. The deep fusion reasoning engine learns resource utilizations for different heuristic packages that can be used in the network to evaluate operation of the network. The deep fusion reasoning engine selects one of the heuristic packages based on the resource utilizations learned for the different heuristic packages. The selected heuristic package comprises a subservice and a set of rules to be evaluated. The deep fusion reasoning engine deploys the selected heuristic package for execution by a device in the network to evaluate operation of the network using the set of rules.

Dynamic heuristic packages and metrics for network assurance using a deep fusion reasoning engine

In one embodiment, a service that monitors a network detects a plurality of anomalies in the network. The service uses data regarding the detected anomalies as input to one or more machine learning models. The service maps, using a conceptual space, outputs of the one or more machine learning models to symbols. The service applies a symbolic reasoning engine to the symbols, to rank the anomalies. The service sends an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.

Deep fusion reasoning engine (DFRE) for prioritizing network monitoring alerts

Systems, methods, and computer-readable for multi-spatial scale object detection include generating one or more object trackers for tracking at least one object detected from on one or more images. One or more blobs are generated for the at least one object based on tracking motion associated with the at least one object. One or more tracklets are generated for the at least one object based on associating the one or more object trackers and the one or more blobs, the one or more tracklets including one or more scales of object tracking data for the at least one object. One or more uncertainty metrics are generated using the one or more object trackers and an embedding of the one or more tracklets. A training module for detecting and tracking the at least one object using the embedding and the one or more uncertainty metrics is generated using deep learning techniques.

Multi-spatial scale analytics

In one embodiment, a network quality assessment service that monitors a network obtains multimodal data indicative of a plurality of measurements from the network and subjective perceptions of the network by users of the network. The network quality assessment service uses the obtained multimodal data as input to one or more neural network-based models. The network quality assessment service maps, using a conceptual space, outputs of the one or more neural network-based models to symbols. The network quality assessment service applies a symbolic reasoning engine to the symbols, to generate a conclusion regarding the monitored network. The network quality assessment service provides an indication of the conclusion to a user interface.

Deep fusion reasoning engine (DFRE) for dynamic and explainable wireless network QoE metrics

A method comprises collecting, by a computing device located at an edge of a network, data items corresponding to information transmitted by endpoints using the network, generating, by the computing device, a probabilistic hierarchy using the data items, generating, by the computing device using the probabilistic hierarchy and natural language data, a similarity metric, generating, by the computing device using the probabilistic hierarchy, the natural language data, and the similarity metric, an ontology, detecting, by the computing device using the ontology, an anomaly, and in response to detecting the anomaly, sending a notification.

Automatic ontology generation for internet of things applications

Presented herein are techniques to analyze network anomaly signals based on both a spatial component and a temporal component. A method includes identifying a plurality of factors that trigger a first anomaly signal by a first network node and a second anomaly signal by a second network node in a network comprising a plurality of network nodes, determining that the first network node is adjacent to the second network node in the plurality of network nodes, calculating an anomaly severity score for the first network node based on a number of co-occurring factors from among the plurality of factors that trigger both the first anomaly signal and the second anomaly signal, and adjusting the anomaly severity score for the first network node based on a value of a prior anomaly severity score for the first network node.

Spatio-temporal event weight estimation for network-level and topology-level representations

Systems, methods, and computer-readable for multi-temporal scale analysis include obtaining two or more timescales associated with one or more images. A context associated with a monitoring objective is obtained, based on real time analytics or domain specific knowledge. The monitoring objective can include object detection, event detection, pattern recognition, or other. At least a subset of timescales for performing a differential analysis on the one or more images is determined based on the context. Multi timescale surprise detection and clustering are performed using the subset of timescales to determine whether any alerts are to be generated based on entropy based surprises. A set of rules can be created for the monitoring objective based on the differential analytics and alerts or entropy based surprises, if any.

Multi-temporal scale analytics

In one embodiment, a controller in a network trains a deep reinforcement learning-based agent to predict traffic flows in the network. The controller determines one or more resource requirements for the predicted traffic flows. The controller assigns, using the deep reinforcement learning-based agent, paths in the network to the flows based on the determined one or more resource requirements, to avoid fragmentation of a flow during transmission of the flow through the network. The controller sends, to nodes in the network, assignment instructions that cause the flows to traverse the network via their assigned paths.

Inspired path computation in a network

In one embodiment, a service obtains spatial information regarding a physical area. The service estimates locations of a device within the physical area over time, based on wireless signals sent by the device. The service generates a set of images based on the spatial information regarding the physical area and on the estimated locations of the device within the physical area over time. The service updates an estimated location of the device by inputting the generated set of images to a machine learning model trained to minimize a location estimation error.

Image-based framework for improving location estimate accuracy in indoor positioning systems

Growing community of inventors

Long Beach, CA, United States of America

Hugo Latapie