Using raw network telemetry traces to generate predictive insights using machine learning

Patent metadata

Field	Value
Publication number	US-11797883-B2
Application number	US-202016809060-A
Country	US
Kind code	B2
Filing date	Mar 4, 2020
Priority date	Mar 4, 2020
Publication date	Oct 24, 2023
Grant date	Oct 24, 2023

Abstract

In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

First claim

What is claimed is:

1. A method comprising:
receiving, at a service, telemetry data collected from a plurality of different networks;
combining, by the service, the telemetry data into a synthetic input trace;
inputting, by the service, the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

2. The method as in claim 1 , further comprising:
providing, by the service, an indication of the identified network as exhibiting an abnormal behavior to a user interface.

3. The method as in claim 2 , further comprising:
receiving, at the service and via the user interface, one or more parameters that specify the telemetry data to be combined into the synthetic input trace.

4. The method as in claim 1 , wherein comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior comprises:
determining that the predicted KPI for the identified network is a statistical outlier among the predicted KPIs for the plurality of different networks.

5. The method as in claim 1 , further comprising:
retrieving, by the service, the first machine learning model from the first network and the second machine learning model from the second network, wherein the service is a cloud-based service in communication with the first and second networks.

6. The method as in claim 1 , wherein combining, by the service, the telemetry data into the synthetic input trace comprises:
performing clustering on the telemetry data received from the plurality of different networks using a defined similarity metric.

7. The method as in claim 1 , further comprising:
splitting, by the service, the telemetry data into sub-sections representative of different network conditions.

8. The method as in claim 7 , wherein the different network conditions are associated with at least one of: a particular timeframe or a number of network clients.

9. An apparatus, comprising:
one or more network interfaces;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive telemetry data collected from a plurality of different networks;
combine the telemetry data into a synthetic input trace;
input the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
compare the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

10. The apparatus as in claim 9 , wherein the process when executed is further configured to:
provide an indication of the identified network as exhibiting an abnormal behavior to a user interface.

11. The apparatus as in claim 10 , wherein the process when executed is further configured to:
receive via the user interface, one or more parameters that specify the telemetry data to be combined into the synthetic input trace.

12. The apparatus as in claim 9 , wherein the apparatus compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior by:
determining that the predicted KPI for the identified network is a statistical outlier among the predicted KPIs for the plurality of different networks.

13. The apparatus as in claim 9 , wherein the process when executed is further configured to:
retrieve the plurality of machine learning models from the plurality of different networks.

14. The apparatus as in claim 9 , wherein the apparatus combines the telemetry data into the synthetic input trace by:
performing clustering on the telemetry data received from the plurality of different networks using a defined similarity metric.

15. The apparatus as in claim 9 , wherein the process when executed is further configured to:
split the telemetry data into sub-sections representative of different network conditions.

16. The apparatus as in claim 15 , wherein the different network conditions are associated with at least one of: a particular timeframe or a number of network clients.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a service to execute a process comprising:
receiving, at the service, telemetry data collected from a plurality of different networks;
combining, by the service, the telemetry data into a synthetic input trace;
inputting, by the service, the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

18. The computer-readable medium as in claim 17 , wherein the process further comprises:
providing, by the service, an indication of the identified network as exhibiting an abnormal behavior to a user interface.

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Cruz Mota Javier
• Dasgupta Sukrit
• Vasseur Jean-Philippe

Classifications

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title

• G06N5/04

  Inference or reasoning models · CPC title