Cisco Technology, Inc.

Vikram Kumaran

Jean-Philippe Vasseur

Santosh Ghanshyam Pandey

Grégory Mermoud

Vinay Kumar Kolar

John Christopher Cottrell

Hao Liu

Saileshwar Krishnamurthy

Hua Zhang

Abhishek Kumar

David Tang

Zhitao Shen

Federico Lovison

In one embodiment, a network assurance system that monitors a network labels time periods with positive labels, based on the network assurance system detecting problems in the network during the time periods. The network assurance system assigns tags to discrete portions of a feature space of measurements from the monitored network, based on whether a particular range of values in the feature space has a threshold probability of occurring during a positively-labeled time period. The network assurance system determines a set of the assigned tags that frequently co-occur with the positively-labeled time periods in which problems are detected in the network. The network assurance system causes performance of a mitigation action in the network based on the set of assigned tags that frequently co-occur with the positively-labeled time periods.

Deriving highly interpretable cognitive patterns for network assurance

In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) tracks a performance metric for a tunnel in the SD-WAN. The supervisory service computes a cumulative distribution function (CDF) for the tracked performance metric. The service assesses curvature of the CDF for the tracked performance metric relative to a service level agreement (SLA) threshold of an application for that performance metric. The service controls assignment of traffic for the application to the tunnel, based on the assessed curvature of the CDF for the tracked performance metric relative to the SLA threshold of the application for that performance metric.

Intelligent tunnel assignment and dynamic SLA threshold configuration to increase availability and utilization of SD-WAN tunnels

In one embodiment, a network assurance service that monitors a network calculates network frequency distributions of a performance measurement from the network over a plurality of different time periods. The service calculates entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods. The service determines distance measurements between the network frequency distributions and the entity frequency distributions. The service identifies a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping. The service provides an indication of the identified outlier grouping to a user interface.

Detecting network entity groups with abnormal time evolving behavior

In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) detects seasonal service level agreement (SLA) violations by one or more tunnels in the SD-WAN using a machine learning-based regression model. The service identifies a root cause of the seasonal SLA violations by determining whether the root cause of the seasonal SLA violations is associated with an internal network connected to the one or more tunnels. The service further identifies the root cause by determining whether the root cause of the seasonal SLA violations is associated with a particular service provider network over which the one or more tunnels traverse by associating the seasonal SLA violations with SLA violations by tunnels in other SD-WANs that also traverse the particular service provider network. The service initiates a corrective measure based on the determined root cause of the seasonal SLA violations by the one or more tunnels.

Root cause analysis of seasonal service level agreement (SLA) violations in SD-WAN tunnels

In one embodiment, a network assurance service that monitors a wireless network receives data regarding connection failures of a wireless client of the wireless network. The network assurance service forms a behavioral profile for the wireless client based on the received data regarding the connection failures of the wireless client. The network assurance service uses machine learning to determine whether the behavioral profile of the wireless client is an outlier in relation to behavioral profiles of other wireless clients of the wireless network. The network assurance service causes performance of a mitigation action with respect to the wireless client, when the wireless client is determined to be an outlier.

Identifying and blacklisting problem clients using machine learning in wireless networks

In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

Using machine learning based on cross-signal correlation for root cause analysis in a network assurance service

Various implementations disclosed herein provide a method for anonymizing data in a distributed hierarchical network. In various implementations, the method includes determining a first set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes that are stored at the first network node and have not been transmitted upstream towards the hub. In various implementations, the method includes receiving, from a second network node, a second set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes at the second network node. In various implementations, the method includes determining whether a sum based on the first and second set of attribute hierarchy counts satisfies an anonymization criterion. In some implementations, the sum indicates a total number of occurrences for a corresponding attribute that are stored at the first and second network nodes and have not been transmitted upstream towards the hub.

Data anonymization for distributed hierarchical networks

In one embodiment, a network assurance service that monitors a network detects a pattern of network measurements from the network that are associated with a particular network problem. The network assurance service tracks characteristics of the detected pattern over time. The network assurance service uses the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer. The pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern. The network assurance service initiates a change to the network based on an output of the machine learning-based pattern analyzer.

Detecting transient vs. perpetual network behavioral patterns using machine learning

Location data is obtained from signals transmitted by a first plurality of mobile wireless devices in a wireless network, wherein the first plurality of mobile wireless devices are moving within a predefined space, and wherein the location data comprises a plurality of location data time points, each location data time point including a timestamp, a unique mobile wireless device identifier, and location information indicating where in the predefined space an associated mobile wireless device is located. For each mobile wireless device, location data time points are aggregated to generate a set of aggregated location data for each mobile wireless device, and the set of aggregated location data is analyzed to determine characteristics corresponding to time-dependent behavior and location-specific behavior of the corresponding mobile wireless device. A user of each corresponding mobile wireless device is classified into a category of a plurality of categories based on the determined characteristics.

Leveraging location data from mobile devices for user classification

In an embodiment, an improved computer-implemented method of efficiently determining actions to perform based on data from a streaming continuous queries in a distributed computer system comprises, at a central control computer, receiving a streaming continuous query and a rule-set; wherein the rule-set comprises decision data representing decisions based on attributes produced by the query, and action data representing end actions based on the decisions, wherein the attributes comprise data processed by one or more networked computers; separating the streaming continuous query into a sub-query executable at one or more edge computers; categorizing end actions from the set based on decisions requiring attributes available from the sub-query into a set of one or more edge expressions that are configured to be evaluated at an edge agent to cause an action; providing the set of edge expressions and the sub-query to at least one edge computer with instructions to process visible attributes on the edge computer and to evaluate the set of one or more edge expressions independently from the central control computer; wherein the method is performed by one or more computing devices.

Integrating rule based systems with distributed data processing by pushing control to edge agents

Methods and apparatus for managing interruptions in a multiple communication mode environment are provided herein. For example, a method may include receiving at least first instance of communication data associated with a first communication mode; obtaining first attribute data related to the first instance of communication data; classifying the first instance of communication data into first category based on the first attribute data using the interruption management device; and determining whether to interrupt a user by delivering the first instance of communication data based on the first category. The first category may be selected from a plurality of predetermined categories using a classification algorithm.

Method and apparatus for managing interruptions from different modes of communication

Methods and apparatus for managing interruptions in a multiple communication mode environment are provided herein. For example, a method may include receiving at least first and second instances of communication data associated with first and second communication modes; obtaining first and attribute data related to the first and second instances of communication data; classifying the first and second instances of communication data into first and second categories based on the first and second attribute data using the interruption management device; and determining whether to interrupt a user by delivering the first instance of communication data or the second instance of communication data based on the first and second categories, respectively. The first category and the second category may be selected from a plurality of predetermined categories using a classification algorithm. The first communication mode may be different than the second communication mode.

Growing community of inventors

Cary, NC, United States of America

Vikram Kumaran