Increased granularity and anomaly correlation using multi-layer distributed analytics in the network

Patent metadata

Field	Value
Publication number	US-10581901-B2
Application number	US-201615154349-A
Country	US
Kind code	B2
Filing date	May 13, 2016
Priority date	Mar 25, 2016
Publication date	Mar 3, 2020
Grant date	Mar 3, 2020

Abstract

In one embodiment, a primary networking device in a branch network receives a notification of an anomaly detected by a secondary networking device in the branch network. The primary networking device is located at an edge of the network. The primary networking device aggregates the anomaly detected by the secondary networking device and a second anomaly detected in the network into an aggregated anomaly. The primary networking device associates the aggregated anomaly with a location of the secondary networking device in the branch network. The primary networking device reports the aggregated anomaly and the associated location of the secondary networking device to a supervisory device.

First claim

What is claimed is:

1. A method comprising:
receiving, at a primary networking device in a branch network, a notification of an anomaly detected by a secondary networking device in the branch network, wherein the primary networking device is located at an edge of the branch network;
identifying, by the primary networking device, an overlap between the anomaly detected by the secondary networking device and a second anomaly detected in the branch network;
aggregating, by the primary networking device and in response to identifying the overlap, the anomaly detected by the secondary networking device and the second anomaly detected in the branch network into an aggregated anomaly;
associating, by the primary networking device, the aggregated anomaly with a location of the secondary networking device in the branch network; and
reporting, by the primary networking device, the aggregated anomaly and the associated location of the secondary networking device to a supervisory device, wherein the supervisory device performs a mitigation measure based on the aggregated anomaly and the associated location.

2. The method as in claim 1 , further comprising:
detecting, by the primary networking device, the second anomaly using a local anomaly detector.

3. The method as in claim 1 , further comprising:
receiving, at the primary networking device, a notification of the second anomaly from another secondary networking device in the branch network that differs from the secondary networking device.

4. The method as in claim 1 , wherein the overlap between the anomaly and the second anomaly is in terms of one or more of: network addresses associated with the anomalies, network ports associated with the anomalies, traffic types associated with the anomalies, or time frames associated with the anomalies.

5. The method as in claim 1 , wherein the primary networking device comprises a router or gateway.

6. The method as in claim 1 , wherein the secondary networking device comprises a Layer-2 switch.

7. The method as in claim 1 , further comprising:
identifying, by the primary networking device, one or more anomaly detectors along a traffic path associated with the anomaly detected by the secondary networking device, based on a Layer-2 topology of the branch network; and
determining, by the primary networking device, whether the anomaly detected by the secondary networking device is a false positive based on whether the identified one or more anomaly detectors also detected an anomaly.

8. The method as in claim 1 , further comprising:
instructing, by the primary networking device, the secondary networking device to perform anomaly detection on a first subset of traffic traversing the secondary networking device, based on the location of the secondary networking device in the network.

9. The method as in claim 8 , further comprising:
instructing, by the primary networking device, the secondary networking device to forward information regarding a second subset of the traffic traversing the secondary networking device to another device in the network for anomaly detection.

10. The method as in claim 8 , further comprising:
querying a status of the secondary networking device; and
instructing the secondary networking device to spin down performance of anomaly detection on the first subset of the traffic traversing the secondary networking device.

11. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive a notification of an anomaly detected by a secondary networking device in the branch network, wherein the primary networking device is located at an edge of the network;
identify an overlap between the anomaly detected by the secondary networking device and a second anomaly detected in the branch network;
aggregate, in response to identification of the overlap, the anomaly detected by the secondary networking device and the second anomaly detected in the network into an aggregated anomaly;
associate the aggregated anomaly with a location of the secondary networking device in the branch network; and
report the aggregated anomaly and the associated location of the secondary networking device to a supervisory device, wherein the supervisory device performs a mitigation measure based on the aggregated anomaly and the associated location.

12. The apparatus as in claim 11 , wherein the process when executed is further configured to:
detect the second anomaly using a local anomaly detector.

13. The apparatus as in claim 11 , wherein the process when executed is further configured to:
receive a notification of the second anomaly from another secondary networking device in the branch network that differs from the secondary networking device.

14. The apparatus as in claim 11 , wherein the overlap between the anomaly and the second anomaly is in terms of one or more of: network addresses associated with the anomalies, network ports associated with the anomalies, traffic types associated with the anomalies, or time frames associated with the anomalies.

15. The apparatus as in claim 11 , wherein the process when executed is further configured to:
send an instruction to the secondary networking device to dynamically adjust which traffic types for which the secondary networking device performs anomaly detection and which traffic types the secondary networking device forwards to another device for anomaly detection.

16. The apparatus as in claim 15 , wherein the secondary networking device comprises a Layer-2 switch.

17. The apparatus as in claim 11 , wherein the process when executed is further configured to:
identify one or more anomaly detectors along a traffic path associated with the anomaly detected by the secondary networking device, based on a Layer-2 topology of the branch network; and
determine whether the anomaly detected by the secondary networking device is a false positive based on whether the identified one or more anomaly detectors also detected an anomaly.

18. The apparatus as in claim 11 , wherein the process when executed is further configured to:
instruct the secondary networking device to perform anomaly detection on a first subset of traffic traversing the secondary networking device, based on the location of the secondary networking device in the network.

19. The apparatus as in claim 18 , wherein the process when executed is further configured to:
instruct the secondary networking device to forward information regarding a second subset of the traffic traversing the secondary networking device to another device in the network for anomaly detection.

20. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor of a primary networking device in a network configured to:
receive a notification of an anomaly detected by a secondary networking device in the network, wherein the primary networking device is located at an edge of the network;
identify an overlap between the anomaly detected by the secondary networking device and a second anomaly detected in the branch network;
aggregate, in response to identification of the overlap, the anomaly detected by the secondary networking device and the second anomaly detected in the network into an aggregated anomaly;
associate the aggregated

Assignees

• Cisco Tech Inc

Inventors

• Dasgupta Sukrit
• Vasseur Jean-Philippe
• Di Pietro Andrea

Classifications

• H04L41/065

  involving logical or physical relationship, e.g. grouping and hierarchies · CPC title

• H04L63/1458 Primary

  Denial of Service · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title