Distributed anomaly detection management

Patent metadata

Field	Value
Publication number	US-10757121-B2
Application number	US-201615212588-A
Country	US
Kind code	B2
Filing date	Jul 18, 2016
Priority date	Mar 25, 2016
Publication date	Aug 25, 2020
Grant date	Aug 25, 2020

Abstract

In one embodiment, a device in a network performs anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network. The device identifies an ability of one or more nodes in the network to perform at least one of the anomaly detection functions. The device selects a particular one of the anomaly detection functions to offload to a particular one of the nodes, based on the ability of the particular node to perform the particular anomaly detection function. The device instructs the particular node to perform the selected anomaly detection function.

First claim

What is claimed is:

1. A method comprising:
performing, by a device in a network, anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in a branch network, wherein the device is an edge switch or an edge router that connects one or more host devices and one or more intermediate devices in the branch network to the network;
identifying, by the device, an ability of one or more nodes in the branch network to perform at least one of the anomaly detection functions, wherein the one or more nodes are the one or more host devices or the one or more intermediate devices in the branch network;
dynamically selecting, by the device, a particular one of the anomaly detection functions to offload to a particular node of the one or more nodes, based on the ability of the particular node to perform the particular anomaly detection function, wherein the particular node is a switch or router in the branch network;
based on the dynamic selection, offloading, by the device, the selected anomaly detection function to the particular node by instructing the particular node to perform the selected anomaly detection function, wherein offloading includes:
instructing, by the device, one or more of the nodes to forward traffic data to the particular node, and
instructing, by the device, the particular node to compute at least a portion of an anomaly detection model for the anomaly detector using the forwarded traffic data;

training, by the device, the anomaly detection model; and
providing, by the device, parameters of the trained anomaly detection model to the particular node to compute at least a portion of the model by updating the model.

2. The method as in claim 1 , wherein the selected anomaly detection function comprises capturing packets for inspection, and wherein instructing the particular node to perform the selected anomaly detection function comprises:
instructing, by the device, the particular node to capture packets of one or more specified traffic flows.

3. The method as in claim 2 , further comprising:
detecting, by the device, an anomaly using the machine learning-based anomaly detector; and, in response,
requesting, by the device, captured packets associated with the detected anomaly from the particular node.

4. The method as in claim 1 , further comprising:
identifying, by the device, a set of the one or more nodes that convey intra-branch traffic in the branch network; and
providing, by the device, the set of nodes that convey intra-branch traffic to a supervisory device.

5. The method as in claim 4 , further comprising:
receiving, at the device, a selection from the supervisory device of one of the set of nodes that conveys intra-branch traffic; and
instructing, by the device, the selected node that conveys intra-branch traffic to capture traffic data regarding at least a portion of the intra-branch traffic for assessment by the anomaly detector.

6. The method as in claim 5 , wherein instructing the selected node that conveys intra-branch traffic to capture traffic data regarding at least a portion of the intra-branch traffic comprises:
instructing, by the device, the selected node to capture traffic associated with a particular host in the branch network.

7. An apparatus, comprising:
one or more network interfaces to communicate with a network and a branch network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
perform anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network, wherein the apparatus is an edge switch or an edge router that connects one or more host devices and one or more intermediate devices in a branch network to the network;
identify an ability of one or more nodes in the branch network to perform at least one of the anomaly detection functions, wherein the one or more nodes are the one or more host devices or the one or more intermediate devices in the branch network;
dynamically select a particular one of the anomaly detection functions to offload to a particular node of the one or more nodes, based on the ability of the particular node to perform the particular anomaly detection function, wherein the particular node comprises a switch or router in the branch network; and
based on the dynamic selection, offload the selected anomaly detection function from the apparatus to the particular node by instructing the particular node to perform the selected anomaly detection function, wherein offloading includes:
instructing one or more of the nodes to forward traffic data to the particular node, and
instructing the particular node to compute at least a portion of an anomaly detection model for the anomaly detector using the forwarded traffic data;

train the anomaly detection model; and
provide parameters of the trained anomaly detection model to the particular node to compute at least a portion of the model by updating the model.

8. The apparatus as in claim 7 , wherein the selected anomaly detection function comprises capturing packets for inspection, and wherein the apparatus instructs the particular node to perform the selected anomaly detection function by:
instructing the particular node to capture packets of one or more specified traffic flows.

9. The apparatus as in claim 8 , wherein the process when executed is further operable to:
detect an anomaly using the machine learning-based anomaly detector; and, in response,
request captured packets associated with the detected anomaly from the particular node.

10. The apparatus as in claim 7 , wherein the process when executed is further operable to:
identify a set of the one or more nodes that convey intra-branch traffic in the branch network; and
provide the set of nodes that convey intra-branch traffic to a supervisory device.

11. The apparatus as in claim 10 , wherein the process when executed is further operable to:
receive a selection from the supervisory device of one of the set of nodes that conveys intra-branch traffic; and
instruct the selected node that conveys intra-branch traffic to capture traffic data regarding at least a portion of the intra-branch traffic for assessment by the anomaly detector.

12. The apparatus as in claim 11 , wherein the apparatus instructs the selected node that conveys intra-branch traffic to capture traffic data regarding at least a portion of the intra-branch traffic by:
instructing the selected node to capture traffic associated with a particular host in the branch network.

13. A method comprising:
identifying, by a device in a network, a set of one or more nodes in a branch network connected to the network that convey intra-branch traffic, wherein the device is an edge switch or an edge router that connects the set of one or more nodes to the network;
providing, by the device, the set of nodes that convey intra-branch traffic to a supervisory device;
receiving, at the device, a selection from the supervisory device of one of the set of nodes that conveys intra-branch traffic, wherein the supervisory device dynamically selects a node that conveys intra-branch traffic based on an ability of the selected node to perform a particular anomaly detection function, wherein the node is a switch or router in the branch network;
instructing, by the device, the selected node that conveys intra-branch traffic instead of the device to capture traffic data regarding at least a portion of the intra-branch traffic for assessment by a machine lea

Assignees

• Cisco Tech Inc

Inventors

• Dasgupta Sukrit
• Vasseur Jean-Philippe
• Di Pietro Andrea

Classifications

• G06N20/00

  Machine learning · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title