Cisco Technology, Inc.

Rachita Agasthy

Navindra Yadav

Abhishek Ranjan Singh

Shih-Chun Chang

Ali Parandehgheibi

Rohit Chandra Prasad

Hoang Viet Nguyen

Varun Sagar Malhotra

Sunil Gupta

Michael Standish Watts

Shashi Gandham

Ellen Christine Scheib

Paul Mach

Ravi Prasad

The disclosed technology relates to intent driven network management. A system is configured to maintain an inventory store comprising records for a set of network entities in a network, wherein each network entity in the set of network entities is associated with a record in the inventory store. The system receives a user intent statement comprising an action and a flow filter representing network data flows on which the action is to be applied and queries, based on the flow filter, the inventory store to identify a plurality of network entities in the set of network entities to which the user intent statement applies. The system generates a plurality of network policies that implement the user intent statement based on the plurality of network entities and the action and enforces the plurality network policies.

Intent driven network policy platform

In one embodiment, a method includes receiving network data at an analytics device, grouping features of the network data into multivariate bins, generating a density for each of the multivariate bins, computing a rareness metric for each of the multivariate bins based on a probability of obtaining a feature in a bin and the probability for all other of the multivariate bins with equal or smaller density, and identifying anomalies based on computed rareness metrics. An apparatus and logic are also disclosed herein.

Method and apparatus for computing cell density based rareness for use in anomaly detection

In one embodiment, a method includes receiving network data at an analytics device, identifying features for the network data at the analytics device, grouping each of the features into bins of varying width at the analytics device, the bins comprising bin boundaries selected based on a probability that data within each of the bins follows a discrete uniform distribution, and utilizing the binned features for anomaly detection. An apparatus and logic are also disclosed herein.

Method and apparatus for grouping features into bins with selected bin boundaries for use in anomaly detection

In one embodiment, a method includes receiving at an analytics module operating at a network device, network traffic data collected from a plurality of sensors distributed throughout a network and installed in network components to obtain the network traffic data, identifying at the analytics module, Domain Name System (DNS) exchanges within the network, associating at the analytics module, the DNS exchanges with process, user, and host information, and identifying at the analytics module, anomalies in the DNS exchanges. An apparatus and logic are also disclosed herein.

Domain name system (DNS) based anomaly detection

Growing community of inventors

Sunnyvale, CA, United States of America

Rachita Agasthy