Trustworthiness index computation in a network assurance system based on data source health monitoring

Patent metadata

Field	Value
Publication number	US-10484255-B2
Application number	US-201715626412-A
Country	US
Kind code	B2
Filing date	Jun 19, 2017
Priority date	Jun 19, 2017
Publication date	Nov 19, 2019
Grant date	Nov 19, 2019

Abstract

In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

First claim

What is claimed is:

1. A method comprising:
receiving, at a device, health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintaining, by the device, a performance model for the data source that models the health of the data source;
computing, by the device, a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjusting, by the device and based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

2. The method as in claim 1 , wherein the one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source comprise one or more weightings applied to the telemetry data.

3. The method as in claim 1 , wherein the performance model for the data source that models the health of the data source comprises an unsupervised machine learning-based model that determines a likeliness of the health status being observed for the data source.

4. The method as in claim 1 , wherein the performance model for the data source that models the health of the data source comprises a supervised machine learning-based model that was trained using a training set of health status data labeled with trustworthiness indexes.

5. The method as in claim 1 , wherein the health status data indicative of the health status of the data source comprises one or more of: a count of dropped telemetry packets of the provided telemetry data, resource utilization by the data source, a response delay of Simple Network Management Protocol (SNMP) queries associated with the data source, or a duration of time associated with performing an SNMP walk of the data source.

6. The method as in claim 1 , further comprising:
controlling, by the device, a frequency at which the health status data is reported to the device.

7. The method as in claim 1 , wherein the data source comprises a switch, router, network access point, or wireless controller in the network.

8. The method as in claim 1 , further comprising:
disabling, by the device, analysis of at least a portion of the telemetry data by the network analyzer based on the trustworthiness index computed for the telemetry data provided by the data source.

9. The method as in claim 1 , wherein the health status data differs from the telemetry data, and wherein the telemetry data is indicative of a behavior of one or more devices in the network that differ from the data source.

10. The method as in claim 1 , further comprising:
analyzing, by the device, the telemetry data using the network analyzer with the one or more adjusted parameters to determine a configuration change for the network; and
implementing, by the device, the determined configuration change for the network.

11. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintain a performance model for the data source that models the health of the data source;
compute a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjust, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

12. The apparatus as in claim 11 , wherein the one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source comprise one or more weightings applied to the telemetry data.

13. The apparatus as in claim 11 , wherein the performance model for the data source that models the health of the data source comprises an unsupervised machine learning-based model that determines a likeliness of the health status being observed for the data source.

14. The apparatus as in claim 11 , wherein the performance model for the data source that models the health of the data source comprises a supervised machine learning-based model that was trained using a training set of health status data labeled with trustworthiness indexes.

15. The apparatus as in claim 11 , wherein the health status data indicative of the health status of the data source comprises one or more of: a count of dropped telemetry packets of the provided telemetry data, resource utilization by the data source, a response delay of Simple Network Management Protocol (SNMP) queries associated with the data source, or a duration of time associated with performing an SNMP walk of the data source.

16. The apparatus as in claim 11 , wherein the process when executed is further configured to:
dynamically adjust which health status data is received based on the telemetry data from the data source that is analyzed by the machine learning-based network analyzer.

17. The apparatus as in claim 11 , wherein the process when executed is further configured to:
disable analysis of at least a portion of the telemetry data by the network analyzer based on the trustworthiness index computed for the telemetry data provided by the data source.

18. The apparatus as in claim 11 , wherein the health status data differs from the telemetry data, and wherein the telemetry data is indicative of a behavior of one or more devices in the network that differ from the data source.

19. The apparatus as in claim 11 , wherein the process when executed is further configured to:
analyze the telemetry data using the network analyzer with the one or more adjusted parameters to determine a configuration change for the network; and
implement the determined configuration change for the network.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
receiving, at the device, health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer;
maintaining, by the device, a performance model for the data source that models the health of the data source;
computing, by the device, a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source; and
adjusting, by the device and based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Mermoud Grégory
• Vasseur Jean-Philippe
• Dasgupta Sukrit

Classifications

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N3/047

  Probabilistic or stochastic networks · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title