Automatic ontology generation for internet of things applications

Patent metadata

Field	Value
Publication number	US-10635704-B2
Application number	US-201615212097-A
Country	US
Kind code	B2
Filing date	Jul 15, 2016
Priority date	Jul 15, 2016
Publication date	Apr 28, 2020
Grant date	Apr 28, 2020

Abstract

A method comprises collecting, by a computing device located at an edge of a network, data items corresponding to information transmitted by endpoints using the network, generating, by the computing device, a probabilistic hierarchy using the data items, generating, by the computing device using the probabilistic hierarchy and natural language data, a similarity metric, generating, by the computing device using the probabilistic hierarchy, the natural language data, and the similarity metric, an ontology, detecting, by the computing device using the ontology, an anomaly, and in response to detecting the anomaly, sending a notification.

First claim

What is claimed is:

1. A method comprising:
monitoring, by a computing device located at an edge of a network, network traffic generated by a plurality of endpoints using the network to collect a plurality of data items corresponding to the network traffic transmitted by the plurality of endpoints using the network;
generating, by the computing device, a probabilistic hierarchy using the plurality of data items corresponding to the network traffic;
generating, by the computing device using the probabilistic hierarchy and natural language data, a similarity metric;
generating, by the computing device using the probabilistic hierarchy, the natural language data, and the similarity metric, a network ontology for the plurality of endpoints;
detecting, by the computing device using the network ontology for the plurality of endpoints, a network anomaly;
in response to detecting the network anomaly, sending a notification;
generating, by the computing device, simulated output for an endpoint of the plurality of endpoints;
comparing, by the computing device, the simulated output to an actual output received from the endpoint of the plurality of endpoints using a confidence metric; and
updating the network ontology in response to the confidence metric exceeding an error threshold.

2. The method of claim 1 , further comprising: sending, by the computing device, the network ontology to a server, wherein the server combines the network ontology with a plurality of other network ontologies received from other computing devices within the network, to generate a complete network ontology for the network.

3. The method of claim 2 , wherein the network ontology is compressed prior to sending the network ontology to the server.

4. The method of claim 1 , wherein the computing device is a network infrastructure device.

5. The method of claim 1 , wherein the network comprises a smart building.

6. The method of claim 1 , wherein the plurality of endpoints comprises one or more of: a motion detector, a video conferencing system, a computer, a microphone, a telephone, a temperature sensor.

7. The method of claim 1 , wherein the plurality of data items comprises one or more of: metadata, a packet header, a packet size, or an inter-packet arrival time.

8. The method of claim 1 , wherein the natural language data is WordNet.

9. The method of claim 1 , wherein the network traffic transmitted by the plurality of endpoints using the network is encrypted.

10. A system comprising:
one or more computing devices located at an edge of a network, each computing device comprising a first processor and a first electronic digital memory storing one or more sequences of instructions which, when executed, cause the first processor to perform:
monitoring network traffic generated by a plurality of endpoints using the network to collect a plurality of data items corresponding to the network traffic transmitted by the plurality of endpoints using the network;
generating a probabilistic hierarchy using the plurality of data items corresponding to the network traffic;
generating, using the probabilistic hierarchy and natural language data, a similarity metric;
generating, using the probabilistic hierarchy, the natural language data, and the similarity metric, a network ontology for the plurality of endpoints;
sending the network ontology to a server;
generating, by the computing device, simulated output for an endpoint of the plurality of endpoints;
comparing, by the computing device, the simulated output to an actual output received from the endpoint of the plurality of endpoints using a confidence metric; and
updating the network ontology in response to the confidence metric exceeding an error threshold;

a server comprising a second processor and a second electronic digital memory storing one or more sequences of instructions which, when executed, cause the second processor to perform:
receiving a plurality of network ontologies each generated by the one or more computing devices;
combining the plurality of network ontologies to generate a complete ontology for the network;
determining that a particular network ontology of the plurality of network ontologies is inconsistent with the complete network ontology;
sending an update to the particular network ontology to the computing device associated with the particular network ontology.

11. The system of claim 10 , wherein the network ontology is compressed prior to sending the network ontology to the server.

12. The system of claim 10 , wherein the one or more computing devices are network infrastructure devices.

13. The system of claim 10 , wherein the network comprises a smart building.

14. The system of claim 10 , wherein the plurality of endpoints comprises one or more of: a motion detector, a video conferencing system, a computer, a microphone, a telephone, a temperature sensor.

15. The system of claim 10 , wherein the plurality of data items comprises one or more of: metadata, a packet header, a packet size, or an inter-packet arrival time.

16. The system of claim 10 , wherein the natural language data is WordNet.

17. An apparatus comprising:
a processor; and
a memory storing one or more sequences of instructions which, when executed, cause the processor to perform:
monitoring network traffic generated by a plurality of endpoints using the network to collect a plurality of data items corresponding to the network traffic transmitted by the plurality of endpoints using the network;
generating a probabilistic hierarchy using the plurality of data items corresponding to the network traffic;
generating, using the probabilistic hierarchy and natural language data, a similarity metric;
generating, using the probabilistic hierarchy, the natural language data, and the similarity metric, a network ontology for the plurality of endpoints;
sending the network ontology to a server;
generating simulated output for an endpoint of the plurality of endpoints;
comparing the simulated output to an actual output received from the endpoint of the plurality of endpoints using a confidence metric; and
updating the network ontology in response to the confidence metric exceeding an error threshold.

18. The apparatus of claim 17 , wherein when executed, the memory further causes the processor to perform:
sending, by the computing device, the network ontology to a server;
wherein the server combines the network ontology with a plurality of other network ontologies received from other computing devices within the network, to generate a complete network ontology for the network.

19. The apparatus of claim 18 , wherein the network ontology is compressed prior to sending the network ontology to the server.

20. The apparatus of claim 17 , wherein the apparatus is a network infrastructure device.

Assignees

• Cisco Tech Inc

Inventors

• Latapie Hugo
• Fenoglio Enzo
• Surcouf Andre
• Friel Joseph T
• Rai Pete

Classifications

• G06F16/9535

  Search customisation based on user profiles and personalisation · CPC title

• G06F16/3344

  using natural language analysis · CPC title

• G06F16/3346

  using probabilistic model · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• G06F16/367 Primary

  Ontology · CPC title