Cisco Technology, Inc.

Sukrit Dasgupta

Jean-Philippe Vasseur

Grégory Mermoud

Jonathan W Hui

Andrea Di Pietro

Fabien Flacher

Sofia Karygianni

Thomas Reuther

Pierre-André Savalle

Santosh Ghanshyam Pandey

Javier Cruz Mota

Joshua B Littlefield

Carlo Zapponi

Xav Laumonier

Hari Rakotoranto

Federico Lovison

In one embodiment, a method can receive transmission metadata associated with a plurality of devices within an Internet of Things (IoT) network. The method can use a transmission sensing component (TSC) to measure transmission energy cost for each of the plurality of devices over a time period using the transmission metadata. The method can use a central compute engine (CCE) and the transmission energy cost for each of the plurality of devices to determine a plurality of transmission features associated with the plurality of devices having a transmission energy cost that is minimized. The method can use a transmission scheduling engine (TSE) and the plurality of transmission features to generate a transmission mode schedule to reduce a transmission energy cost for the plurality of devices within the IoT network. The method can adjust a transmission mode associated with the plurality of devices based on the transmission mode schedule.

Dynamic WiFi transmit power reduction to conserve device power in a mixed 5G/WiFi service area

In one embodiment, a central agent obtains device inventory data from a plurality of networks regarding endpoint devices in those networks. The central agent receives a request for a behavioral model for a particular type of endpoint device. The central agent selects one or more networks of the plurality of networks to export traffic data associated with endpoint devices of the particular type. The central agent configures one or more export agents at the one or more networks to export the traffic data. The traffic data exported by the one or more export agents is used to train the behavioral model.

Using device behavior knowledge across peers to remove commonalities and reduce telemetry collection

In one embodiment, a device determines a criticality of each of a plurality of endpoints in a network, based on network telemetry data regarding the network. The device translates a plurality of anomaly detection models available for deployment to the network and their metadata into a set of adjustable resources. The device generates an anomaly detection deployment strategy for the network by selecting a set of one or more of the plurality of anomaly detection models for deployment to one or more execution points in the network, based on the criticality of each of the plurality of endpoints and on the set of adjustable resources. The device causes the set to be deployed to the one or more execution points in the network, in accordance with the anomaly detection deployment strategy.

Deploying network anomaly detection systems based on endpoint criticality

In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

Using raw network telemetry traces to generate predictive insights using machine learning

In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Traffic-based inference of influence domains in a network by using learning machines

In one embodiment, a network assurance service that monitors a network detects a network anomaly in the network using a machine learning-based anomaly detector. The network assurance service identifies a set of network conditions associated with the detected network anomaly. The network assurance service initiates a network test on one or more clients in the network that exhibit the identified network conditions. The network assurance service retrains the machine learning-based anomaly detector based on a result of the network test.

Machine learning-based client selection and testing in a network assurance system

The technology provides for providing an interactive user interface to explore a complete network, see relationships with various aspects of the network, and drill down to details in an instinctive manner. In some embodiments, network component data is received that identifies metrics associated with network components. A graphical user interface made up of representations of network components of a network is presented, where the network components are selectable. Relevant network components are displayed at varying network scales by receiving an input selecting a first representation of a first network component at a first network level. Based on a network component relationship between the first representation of the first network component and a second relationship of a second network component, second network component data is received that identifies one or more metrics associated with the second network component. The second network component is at a second network level. The one or more metrics associated with the second network component are presented within a context of the second network level.

Interactive interface for network exploration with relationship mapping

In one embodiment, a device in a network receives anomaly data regarding an anomaly detected by a machine learning-based anomaly detection mechanism of a first node in the network. The device matches the anomaly data to threat intelligence feed data from one or more threat intelligence services. The device determines whether to provide threat intelligence feedback to the first node based on the matched threat intelligence feed data and one or more policy rules. The device provides threat intelligence feedback to the first node regarding the matched threat intelligence feed data, in response to determining that the device should provide threat intelligence feedback to the first node.

Distributed feedback loops from threat intelligence feeds to distributed machine learning systems

In one embodiment, a device in a network performs anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network. The device identifies an ability of one or more nodes in the network to perform at least one of the anomaly detection functions. The device selects a particular one of the anomaly detection functions to offload to a particular one of the nodes, based on the ability of the particular node to perform the particular anomaly detection function. The device instructs the particular node to perform the selected anomaly detection function.

Distributed anomaly detection management

In one embodiment, a primary networking device in a branch network receives a notification of an anomaly detected by a secondary networking device in the branch network. The primary networking device is located at an edge of the network. The primary networking device aggregates the anomaly detected by the secondary networking device and a second anomaly detected in the network into an aggregated anomaly. The primary networking device associates the aggregated anomaly with a location of the secondary networking device in the branch network. The primary networking device reports the aggregated anomaly and the associated location of the secondary networking device to a supervisory device.

Increased granularity and anomaly correlation using multi-layer distributed analytics in the network

In one embodiment, a node in a network detects an anomaly in the network based on a result of a machine learning-based anomaly detector analyzing network traffic. The node determines a packet capture policy for the anomaly by applying a machine learning-based classifier to the result of the anomaly detector. The node selects a set of packets from the analyzed traffic based on the packet capture policy. The node stores the selected set of packets for the detected anomaly.

Adaptive capture of packet traces based on user feedback learning

In one embodiment, a first device in a network maintains raw traffic flow information for the network. The first device provides a compressed summary of the raw traffic flow information to a second device in the network. The second device is configured to transform the compressed summary for presentation to a user interface. The first device detects an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector. The first device provides at least a portion of the raw traffic flow information related to the anomalous traffic flow to the second device for presentation to the user interface.

Data visualization in self-learning networks

In one embodiment, a first device in a network identifies an anomalous traffic flow in the network. The first device reports the anomalous traffic flow to a supervisory device in the network. The first device determines a quarantine policy for the anomalous traffic flow. The first device determines an action policy for the anomalous traffic flow. The first device applies the quarantine and action policies to one or more packets of the anomalous traffic flow.

Packet capture for anomalous traffic flows

In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

Growing community of inventors

Norwood, MA, United States of America

Sukrit Dasgupta