Cisco Technology, Inc.

Javier Cruz Mota

Jean-Philippe Vasseur

Andrea Di Pietro

Grégory Mermoud

Pierre-André Savalle

Abhishek Kumar

Erwan Barry Tarik Zerhouni

Jonathan W Hui

Laurent Sartran

Sébastien Gay

Sukrit Dasgupta

Jean-Phillippe Vasseur

The present technology pertains to a system, method, and non-transitory computer-readable medium for evaluating the impact of network changes. The technology can detect a temporal event, wherein the temporal event is associated with a change in a network configuration, implementation, or utilization; define a first period prior to the temporal event and a second period posterior to the temporal event; and compare network data collected in the first period and network data collected in the second period.

Analyzing the impact of network events across time

In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.

Automatic characterization of AP behaviors

In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

Using raw network telemetry traces to generate predictive insights using machine learning

The disclosed technology relates to a process of providing dynamic machine learning on premise model selection. In particular, a set of machine learned models are generated and provided to an on premise computing device. The machine learned models are generated using a cluster of customer data (e.g. telemetric data) stored on a computing network having different ranges of computational complexity. One of the machine learned models from the set of machine learned models will be selected based on the current available computational resources detected at the on premise computing device. Different machine learned models from the set of machine learned models can then be selected based on changes in the available computational resources and/or customer feedback.

Dynamic machine learning on premise model selection based on entity clustering and feedback

The present technology pertains to a system, method, and non-transitory computer-readable medium for evaluating the impact of network changes. The technology can detect a temporal event, wherein the temporal event is associated with a change in a network configuration, implementation, or utilization. The technology defines, based on a nature of the temporal event, a first period prior to the temporal event or a second period posterior to the temporal event. The technology compares network data collected in the first period and network data collected in the second period.

System and method of comparing time periods before and after a network temporal event

In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.

Roaming and transition patterns coding in wireless networks for cognitive visibility

Technologies for dynamically generating topology and location based network insights are provided. In some examples, a method can include determining statistical changes in time series data including a series of data points associated with one or more conditions or parameters of a network; determining a period of time corresponding to one or more of the statistical changes in the time series data; obtaining telemetry data corresponding to a segment of the network and one or more time intervals, wherein a respective length of each time interval is based on a length of the period of time corresponding to the one or more of the statistical changes in the time series data; and generating, based on the telemetry data, insights about the segment of the network, the insights identifying a trend or statistical deviation in a behavior of the segment of the network during the one or more time intervals.

Technologies for dynamically generating network topology-based and location-based insights

In one embodiment, possible voting nodes in a network are identified. The possible voting nodes each execute a classifier that is configured to select a label from among a plurality of labels based on a set of input features. A set of one or more eligible voting nodes is selected from among the possible voting nodes based on a network policy. Voting requests are then provided to the one or more eligible voting nodes that cause the one or more eligible voting nodes to select labels from among the plurality of labels. Votes are received from the eligible voting nodes that include the selected labels and are used to determine a voting result.

Designating a voting classifier using distributed learning machines

In one embodiment, a device in a network receives information regarding a network anomaly detected by an anomaly detector deployed in the network. The device identifies the detected network anomaly as a false positive based on the information regarding the network anomaly. The device generates an output filter for the anomaly detector, in response to identifying the detected network anomaly as a false positive. The output filter is configured to filter an output of the anomaly detector associated with the false positive. The device causes the generated output filter to be installed at the anomaly detector.

Filtering mechanism to reduce false positives of ML-based anomaly detectors and classifiers

In one embodiment, a network assurance service receives data regarding a monitored network. The service analyzes the received data using a machine learning-based model, to perform a network assurance function for the monitored network. The service detects a lowered performance of the machine learning-based model when a performance metric of the machine learning-based model is below a threshold for the performance metric. When it is determined that the lowered performance of the machine-learning based model is correlated with the sample rate of the received data, the service adjusts the sample rate of the data.

Dynamically adjusting sample rates based on performance of a machine-learning based model for performing a network assurance function in a network assurance system

In one embodiment, a local service of a network reports configuration information regarding the network to a cloud-based network assurance service. The local service receives a classifier selected by the cloud-based network assurance service based on the configuration information regarding the network. The local service classifies, using the received classifier, telemetry data collected from the network, to select a modeling strategy for the network. The local service installs, based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.

Dynamic selection of models for hybrid network assurance architectures

In one embodiment, a device in a network determines cluster assignments that assign traffic data regarding traffic in the network to activity level clusters based on one or more measures of traffic activity in the traffic data. The device uses the cluster assignments to predict seasonal activity for a particular subset of the traffic in the network. The device determines an activity level for new traffic data regarding the particular subset of traffic in the network. The device detects a network anomaly by comparing the activity level for the new traffic data to the predicted seasonal activity.

Detection and analysis of seasonal network patterns for anomaly detection

In one embodiment, a network assurance service receives, from a reporting entity, data regarding a monitored network for input to a machine learning-based analyzer of the network assurance service. The service forms a reporting entity model of the reporting entity, based on at least a portion of the data received from the reporting entity. The service identifies a behavioral change of the reporting entity by comparing a sample of the data received from the reporting entity to the reporting entity model. The service correlates the behavioral change of the reporting entity to a change made to the reporting entity. The service causes performance of a mitigation action, to prevent the behavioral change from affecting operation of the machine learning-based analyzer.

Growing community of inventors

Assens, Switzerland

Javier Cruz Mota