Prediction of network device control plane instabilities

Patent metadata

Field	Value
Publication number	US-10977574-B2
Application number	US-201715432385-A
Country	US
Kind code	B2
Filing date	Feb 14, 2017
Priority date	Feb 14, 2017
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

In one embodiment, a device in a network receives control plane packet data indicative of control plane packets for a control plane in the network. The device models the control plane using a machine learning model based on the control plane packet data. The device predicts an instability in the control plane using the machine learning model. The device causes performance of a mitigation action based on the predicted instability in the control plane.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device in a network, control plane packet data indicative of control plane packets for a control plane in the network, wherein the control plane is responsible for signaling that controls how data traffic in the network is communicated across the network;
extracting, by the device, one or more features from the control plane packet to be used as input to a machine learning model;
modeling, by the device and based on a variational Bayesian approach, the control plane by using the one or more extracted features as input to the machine learning model, wherein the one or more extracted features are processed by a variational Bayesian learner which outputs a probability of an instability in the control plane;
predicting, by the device, the instability in the control plane caused by a next stream of control plane packets predicted by the machine learning model, wherein the instability comprises at least one of routing protocol-based flapping, uncontrolled multicast packet replication, high resource consumption, adjacency losses, or timer expirations; and
causing, by the device, performance of a mitigation action based on the predicted instability in the control plane.

2. The method as in claim 1 , wherein the mitigation action comprises at least one of: generating a notification regarding the predicted instability or initiate a configuration change in the network.

3. The method as in claim 1 , wherein the device comprises a network router or network switch.

4. The method as in claim 1 , wherein the control plane packets comprise routing protocol packets.

5. The method as in claim 1 , further comprising:
executing, by the device, a machine learning-based classifier to determine a cause of the predicted instability.

6. The method as in claim 1 , wherein modeling the control plane using the machine learning model based on the control plane packet data comprises:
preprocessing, by the device, the control plane packet data using a recurrent temporal learning model, wherein the device processes a preprocessed control plane packet data using the variational Bayesian approach.

7. The method as in claim 6 , wherein the recurrent temporal learning model comprises one of: a variational recurrent autoencoder (VRAE), a long short term memory (LSTM), or a recurrent neural network (RNN).

8. The method as in claim 1 , wherein the control plane packet data indicates a reappearance of an expired packet flow in the control plane or indicates a control plane event.

9. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process, comprising:
receiving, at the device, control plane packet data indicative of control plane packets for a control plane in the network, wherein the control plane is responsible for signaling that controls how data traffic in the network is communicated across the network;
extracting, by the device, one or more features from the control plane packet to be used to model the control plane as a machine learning model;
modeling, by the device and based on a variational Bayesian approach, the control plane by using the one or more extracted features as input to the machine learning model, wherein the one or more extracted features are processed by a variational Bayesian learner which outputs a probability of an instability in the control plane;
predicting, by the device, the instability in the control plane caused by a next stream of control plane packets predicted by the machine learning model, wherein the instability comprises at least one of routing protocol-based flapping, uncontrolled multicast packet replication, high resource consumption, adjacency losses, or timer expirations; and
causing, by the device, performance of a mitigation action based on the predicted instability in the control plane.

10. The computer-readable medium as in claim 9 , wherein the control plane packets comprise routing protocol packets.

11. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive control plane packet data indicative of control plane packets for a control plane in the network, wherein the control plane is responsible for signaling that controls how data traffic in the network is communicated across the network;
extract one or more features from the control plane packet to be used as input to a machine learning model;
model, based on a variational Bayesian approach, the control plane by using the one or more extracted features as input to the machine learning model, wherein the one or more extracted features are processed by a variational Bayesian learner which outputs a probability of an instability in the control plane;
predict the instability in the control plane caused by a next stream of control plane packets predicted by the machine learning model, wherein the instability comprises at least one of routing protocol-based flapping, uncontrolled multicast packet replication, high resource consumption, adjacency losses, or timer expirations; and
cause performance of a mitigation action based on the predicted instability in the control plane.

12. The apparatus as in claim 11 , wherein the apparatus comprises a network router or network switch.

13. The apparatus as in claim 11 , wherein the control plane packets comprise routing protocol packets.

14. The apparatus as in claim 11 , wherein the mitigation action comprises at least one of: generating a notification regarding the predicted instability or initiate a configuration change in the network.

15. The apparatus as in claim 11 , wherein the apparatus models the control plane using the machine learning model based on the control plane packet data by:
preprocessing the control plane packet data using a recurrent temporal learning model, wherein the apparatus processes a preprocessed control plane packet data using the variational Bayesian approach.

16. The apparatus as in claim 15 , wherein the recurrent temporal learning model comprises one of: a variational recurrent autoencoder (VRAE), a long short term memory (LSTM), or a recurrent neural network (RNN).

17. The apparatus as in claim 11 , wherein the control plane packet data indicates a reappearance of an expired packet flow in the control plane or indicates a control plane event.

18. The apparatus as in claim 11 , wherein the process when executed is further operable to:
execute a machine learning-based classifier to determine a cause of the predicted instability.

Assignees

• Cisco Tech Inc

Inventors

• Goloubew Dmitry
• Salgueiro Gonzalo
• Fenoglio Enzo
• Latapie Hugo
• Surcouf Andre

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title