Detecting transient vs. perpetual network behavioral patterns using machine learning

Patent metadata

Field	Value
Publication number	US-2019238421-A1
Application number	US-201815880600-A
Country	US
Kind code	A1
Filing date	Jan 26, 2018
Priority date	Jan 26, 2018
Publication date	Aug 1, 2019
Grant date	—

Abstract

In one embodiment, a network assurance service that monitors a network detects a pattern of network measurements from the network that are associated with a particular network problem. The network assurance service tracks characteristics of the detected pattern over time. The network assurance service uses the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer. The pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern. The network assurance service initiates a change to the network based on an output of the machine learning-based pattern analyzer.

First claim

What is claimed is:

1 . A method comprising:
detecting, by a network assurance system that monitors a network, a pattern of network measurements from the network that are associated with a particular network problem; tracking, by the network assurance service, characteristics of the detected pattern over time; using, by the network assurance service, the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer, wherein the pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and wherein the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern; and initiating, by the network assurance service, a change to the network based on an output of the machine learning-based pattern analyzer.

2 . The method as in claim 1 , wherein the change to the network comprises at least one of: assigning a wireless access point to a different channel, replacing network equipment, or adjusting resource reservations in the network to satisfy a service level agreement.

3 . The method as in claim 1 , wherein the characteristics of the detected pattern are indicative of a number of clients affected by the network problem.

4 . The method as in claim 1 , wherein the characteristics of the detected patterns are indicative of how well the pattern predicts the particular network problem and comprises at least one of: a precision, a recall, a number of true positives, or a number of false positives, of the prediction.

5 . The method as in claim 1 , wherein the machine learning-based pattern analyzer is further configured to detect change points at which the pattern of network measurements depart from historical trends.

6 . The method as in claim 1 , wherein the machine learning-based pattern analyzer comprises a set of time series analyzers.

7 . The method as in claim 1 , further comprising:
determining, by the network assurance service, whether the pattern of network measurements were observed in one or more other networks.

8 . The method as in claim 1 , further comprising:
providing, by the network assurance service, display data indicative of the output of the machine learning-based pattern analyzer to a user interface.

9 . An apparatus, comprising:
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to:
detect a pattern of network measurements from the network that are associated with a particular network problem;
track characteristics of the detected pattern over time;
use the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer, wherein the pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and wherein the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern; and
initiate a change to the network based on an output of the machine learning-based pattern analyzer.

10 . The apparatus as in claim 9 , wherein the change to the network comprises at least one of: assigning a wireless access point to a different channel, replacing network equipment, or adjusting resource reservations in the network to satisfy a service level agreement.

11 . The apparatus as in claim 9 , wherein the characteristics of the detected pattern are indicative of a number of clients affected by the network problem.

12 . The apparatus as in claim 9 , wherein the characteristics of the detected patterns are indicative of how well the pattern predicts the particular network problem and comprises at least one of: a precision, a recall, a number of true positives, or a number of false positives, of the prediction.

13 . The apparatus as in claim 9 , wherein the machine learning-based pattern analyzer is further configured to detect change points at which the pattern of network measurements depart from historical trends.

14 . The apparatus as in claim 9 , wherein the machine learning-based pattern analyzer comprises a set of time series analyzers.

15 . The apparatus as in claim 9 , wherein the process when executed is further configured to:
determine whether the pattern of network measurements were observed in one or more other networks.

16 . The apparatus as in claim 9 , wherein the process when executed is further configured to:
provide data indicative of the output of the machine learning-based pattern analyzer to a user interface.

17 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service that monitors a network to execute a process comprising:
detecting, by the network assurance service, a pattern of network measurements from the network that are associated with a particular network problem; tracking, by the network assurance service, characteristics of the detected pattern over time; using, by the network assurance service, the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer, wherein the pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and wherein the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern; and initiating, by the network assurance service, a change to the network based on an output of the machine learning-based pattern analyzer.

18 . The computer-readable medium as in claim 17 , wherein the network assurance service comprises a cloud-based service that receives the measurements from the network.

19 . The computer-readable medium as in claim 17 , wherein the characteristics of the detected pattern are indicative of a number of clients affected by the network problem and indicative of how well the pattern predicts the particular network problem and comprises at least one of: a precision, a recall, a number of true positives, or a number of false positives, of the prediction.

20 . The computer-readable medium as in claim 17 , wherein the machine learning-based pattern analyzer is further configured to detect change points at which the pattern of network measurements depart from historical trends.

Assignees

• Cisco Tech Inc

Inventors

• Kolar Vinay Kumar
• Vasseur Jean-Philippe
• Kumaran Vikram
• Pandey Santosh Ghanshyam

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/5025

  by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade · CPC title

• H04L41/147 Primary

  for predicting network behaviour · CPC title