Cisco Technology, Inc.

Srinivasan Arashanipalai

Chi Cao Minh

In one embodiment, a monitoring device ingests a plurality of data records sequentially from a data stream, each having an associated timestamp, and builds a cluster pattern for a plurality of time periods by placing each data record into a corresponding cluster of a particular time period based on the associated timestamp of each data record. The monitoring device then establishes connection between clusters of different time periods by assigning each data record of each particular time period to both an adjacent preceding and succeeding time period. The monitoring device may detect cluster transitions based on the established connections between clusters of different time periods, and can compute cluster migration metrics based on the cluster transitions. The monitoring device then predicts future cluster migration metrics based on computed cluster migration metrics, detects an anomaly about the predicted future cluster migration metrics, and reacts to the anomaly, accordingly.

Growing community of inventors

Nashotah, WI, United States of America

Srinivasan Arashanipalai