Adjusting anomaly detection operations based on network resources

Patent metadata

Field	Value
Publication number	US-2017279685-A1
Application number	US-201615212617-A
Country	US
Kind code	A1
Filing date	Jul 18, 2016
Priority date	Mar 25, 2016
Publication date	Sep 28, 2017
Grant date	—

Abstract

In one embodiment, a device in a network monitors a selective anomaly forwarding mechanism deployed in the network. The selective anomaly forwarding mechanism causes a participating node in the mechanism to selectively forward detected network anomalies to the device. The device monitors one or more resources of the network. The device determines an adjustment to the selective anomaly forwarding mechanism based on the one or more monitored resources of the network. The device implements the determined adjustment to the selective anomaly forwarding mechanism.

First claim

What is claimed is:

1 . A method comprising:
monitoring, by a device in a network, a selective anomaly forwarding mechanism deployed in the network, wherein the selective anomaly forwarding mechanism causes a participating node in the mechanism to selectively forward detected network anomalies to the device; monitoring, by the device, one or more resources of the network; determining, by the device, an adjustment to the selective anomaly forwarding mechanism based on the one or more monitored resources of the network; and implementing, by the device, the determined adjustment to the selective anomaly forwarding mechanism.

2 . The method as in claim 1 , wherein the participating node is a distributed learning agent configured to detect network anomalies using a machine learning-based anomaly detector.

3 . The method as in claim 1 , wherein the participating node is an intermediate node between the device and a distributed learning agent configured to detect network anomalies using a machine learning-based anomaly detector.

4 . The method as in claim 1 , further comprising:
identifying, by the device, a particular node in the network as a bottleneck based on the monitored one or more resources, wherein the adjustment to the selective anomaly forwarding mechanism comprises adding the bottleneck as a participant in the selective anomaly forwarding mechanism.

5 . The method as in claim 1 , wherein the determined adjustment comprises at least one of: a forwarding cost used by the participant to select an anomaly for forwarding, a time window during which the participant is to forward an anomaly, or a forwarding destination to which the participant is to forward an anomaly.

6 . The method as in claim 1 , wherein monitoring the selective anomaly forwarding mechanism comprises:
receiving, at the device, an anomaly reporting digest from the participant in the selective anomaly forwarding mechanism regarding a detected anomaly; and wherein implementing the determined adjustment to the selective anomaly forwarding mechanism comprises: sending, by the device, feedback to the participant regarding the anomaly reporting digest that is indicative of whether the detected anomaly is relevant, wherein the participant uses the feedback to adjust a reporting budget used by the participant to selectively forward anomalies.

7 . The method as in claim 1 , further comprising:
using, by the device, a machine learning-based classifier to determine whether the detected anomaly is relevant.

8 . The method as in claim 1 , wherein determining the adjustment to the selective anomaly forwarding mechanism comprises:
determining, by the device, an anomaly reporting budget for a particular participant based on the one or more monitored resources of the network; and wherein implementing the determined adjustment to the selective anomaly forwarding mechanism comprises: instructing, by the device, the particular participant to use the anomaly reporting budget to selectively forward detected anomalies.

9 . The method as in claim 1 , further comprising:
receiving, at the device, forwarded anomalies detected in the network; and selectively forwarding, by the device, the received anomalies to a user interface for presentation to user based on a determined relevancy to the user.

10 . An apparatus, comprising:
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to:
monitor a selective anomaly forwarding mechanism deployed in the network, wherein the selective anomaly forwarding mechanism causes a participating node in the mechanism to selectively forward detected network anomalies to the apparatus;
monitor one or more resources of the network;
determine an adjustment to the selective anomaly forwarding mechanism based on the one or more monitored resources of the network; and
implement the determined adjustment to the selective anomaly forwarding mechanism.

11 . The apparatus as in claim 10 , wherein the participating node is a distributed learning agent configured to detect network anomalies using a machine learning-based anomaly detector.

12 . The apparatus as in claim 10 , wherein the participating node is an intermediate node between the apparatus and a distributed learning agent configured to detect network anomalies using a machine learning-based anomaly detector.

13 . The apparatus as in claim 10 , wherein the process when executed is further operable to:
identify a particular node in the network as a bottleneck based on the monitored one or more resources, wherein the adjustment to the selective anomaly forwarding mechanism comprises adding the bottleneck as a participant in the selective anomaly forwarding mechanism.

14 . The apparatus as in claim 10 , wherein the determined adjustment comprises at least one of: a forwarding cost used by the participant to select an anomaly for forwarding, a time window during which the participant is to forward an anomaly, or a forwarding destination to which the participant is to forward an anomaly.

15 . The apparatus as in claim 10 , wherein the apparatus monitors the selective anomaly forwarding mechanism by:
receiving an anomaly reporting digest from the participant in the selective anomaly forwarding mechanism regarding a detected anomaly; and wherein the apparatus implements the determined adjustment to the selective anomaly forwarding mechanism by: sending feedback to the participant regarding the anomaly reporting digest that is indicative of whether the detected anomaly is relevant, wherein the participant uses the feedback to adjust a reporting budget used by the participant to selectively forward anomalies.

16 . The apparatus as in claim 10 , wherein the process when executed is further operable to:
use a machine learning-based classifier to determine whether the detected anomaly is relevant.

17 . The apparatus as in claim 10 , wherein the apparatus determines the adjustment to the selective anomaly forwarding mechanism by:
determining an anomaly reporting budget for a particular participant based on the one or more monitored resources of the network; and wherein the apparatus implements the determined adjustment to the selective anomaly forwarding mechanism by: instructing the particular participant to use the anomaly reporting budget to selectively forward detected anomalies.

18 . The apparatus as in claim 10 , wherein the process when executed is further operable to:
receive forwarded anomalies detected in the network; and selectively forward the received anomalies to a user interface for presentation to user based on a determined relevancy to the user.

19 . The apparatus as in claim 10 , wherein the participant is an edge router.

20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
monitoring, by the device, a selective anomaly forwarding mechanism deployed in the network, wherein the selective anomaly forwarding mechanism causes a participating node in the mechanism to selectively forward detected network anomalies to the device; monitoring, by the device, one or more resources of the network; determining, by the device, an adjustment to the selective anomaly forwarding mechanism based on the one or more monitored

Assignees

• Cisco Tech Inc

Inventors

• Mota Javier Cruz
• Mermoud Grégory
• Vasseur Jean-Philippe
• Flacher Fabien

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title