Dynamic selection of models for hybrid network assurance architectures

Patent metadata

Field	Value
Publication number	US-10673728-B2
Application number	US-201815880689-A
Country	US
Kind code	B2
Filing date	Jan 26, 2018
Priority date	Jan 26, 2018
Publication date	Jun 2, 2020
Grant date	Jun 2, 2020

Abstract

In one embodiment, a local service of a network reports configuration information regarding the network to a cloud-based network assurance service. The local service receives a classifier selected by the cloud-based network assurance service based on the configuration information regarding the network. The local service classifies, using the received classifier, telemetry data collected from the network, to select a modeling strategy for the network. The local service installs, based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.

First claim

What is claimed is:

1. A method comprising:
reporting, by a local service of a network, configuration information regarding the network to a cloud-based network assurance service;
receiving, at the local service, a classifier generated by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;
classifying, by the local service and using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service; and
installing, by the local service and based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.

2. The method as in claim 1 , wherein the installed machine learning-based model is a machine learning-based anomaly detector or a trained machine learning-based classifier that assesses traffic information from the network.

3. The method as in claim 1 , further comprising:
reporting, by the local service and to the cloud-based network assurance service, a set of potential input features for the classifier that are available to the local service.

4. The method as in claim 1 , further comprising:
receiving, at the local service and from the cloud-based network assurance service, the machine learning-based model, wherein the cloud-based network assurance service trained the model, and wherein the modeling strategy specifies the trained model for installation.

5. The method as in claim 1 , wherein installing, by the local service and based on the modeling strategy for the network, the machine learning-based model to the local service for monitoring the network comprises:
training, by the local service, the machine learning-based model according to the modeling strategy, wherein the modeling strategy is determined by an output of the received classifier.

6. The method as in claim 5 , wherein the modeling strategy specifies at least one of: a time window, percentile value, type of anomaly detection, or rescaling factor to be used by the machine learning-based model.

7. The method as in claim 1 , further comprising:
detecting, by the local service, a change in input features from the network for the classifier; and, in response,
requesting, by the local service, a new classifier from the cloud-based network assurance service.

8. The method as in claim 1 , further comprising:
identifying, by the local service, expiration of a reporting timer, wherein the local service reports the configuration information regarding the network to the cloud-based network assurance service after expiration of the reporting timer.

9. The method as in claim 1 , wherein classifying the telemetry data collected from the network, to select a modeling strategy for the network, further comprises:
classifying, using the received classifier, Simple Network Management Protocol (SNMP), Internet Protocol Flow Information Export (IPFIX), or Netflow information from the network.

10. The method as in claim 1 , further comprising:
using, by the local service, the installed machine learning-based model to monitor the network; and
controlling, by the local service, operation of the network based on the monitoring.

11. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
report configuration information regarding the network to a cloud-based network assurance service;
receive a classifier generated by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;
classify, using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service; and
install, based on the modeling strategy for the network, a machine learning-based model for monitoring the network.

12. The apparatus as in claim 11 , wherein the installed machine learning-based model is a machine learning-based anomaly detector or a trained machine learning-based classifier that assesses traffic information from the network.

13. The apparatus as in claim 11 , wherein the apparatus receives the classifier selected by the cloud-based network assurance service by:
receiving, from the cloud-based network assurance service, a set of input features required by the classifier.

14. The apparatus as in claim 11 , wherein the process when executed is further configured to:
receive, from the cloud-based network assurance service, the machine learning-based model, wherein the cloud-based network assurance service trained the model, and wherein the modeling strategy specifies the trained model for installation.

15. The apparatus as in claim 11 , wherein the apparatus installs, based on the modeling strategy for the network, the machine learning-based model for monitoring the network by:
training the machine learning-based model according to the modeling strategy, wherein the modeling strategy is determined by an output of the received classifier.

16. The apparatus as in claim 15 , wherein the modeling strategy specifies at least one of: a time window, percentile value, type of anomaly detection, or rescaling factor to be used by the machine learning-based model.

17. The apparatus as in claim 11 , wherein the process when executed is further configured to:
detect a change in input features from the network for the classifier; and, in response,
request a new classifier from the cloud-based network assurance service.

18. The apparatus as in claim 11 , wherein the process when executed is further configured to:
identify an expiration of a reporting timer, wherein the configuration information regarding the network is reported to the cloud-based network assurance service after expiration of the reporting timer.

19. The apparatus as in claim 11 , wherein the apparatus classifies the telemetry data collected from the network, to select a modeling strategy for the network, by:
classifying, using the received classifier, Simple Network Management Protocol (SNMP), Internet Protocol Flow Information Export (IPFIX), or Netflow information from the network.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a local service in a network to execute a process comprising:
reporting, by the local service of the network, configuration information regarding the network to a cloud-based network assurance service;
receiving, at the local service, a generated selected by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;
classifying, by the local service and using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Vasseur Jean-Philippe
• Mota Javier Cruz
• Mermoud Grégory

Classifications

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/5019

  Ensuring fulfilment of SLA · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title

• H04L41/0853

  by actively collecting configuration information or by backing up configuration information · CPC title

• H04L41/0213

  Standardised network management protocols, e.g. simple network management protocol [SNMP] · CPC title