Designating a voting classifier using distributed learning machines

Patent metadata

Field	Value
Publication number	US-2020007412-A1
Application number	US-201916564176-A
Country	US
Kind code	A1
Filing date	Sep 9, 2019
Priority date	May 8, 2014
Publication date	Jan 2, 2020
Grant date	—

Abstract

In one embodiment, possible voting nodes in a network are identified. The possible voting nodes each execute a classifier that is configured to select a label from among a plurality of labels based on a set of input features. A set of one or more eligible voting nodes is selected from among the possible voting nodes based on a network policy. Voting requests are then provided to the one or more eligible voting nodes that cause the one or more eligible voting nodes to select labels from among the plurality of labels. Votes are received from the eligible voting nodes that include the selected labels and are used to determine a voting result.

First claim

What is claimed is:

1 . A method, comprising:
receiving, at a device from another device in a computer network, an availability request that requests the device discover a plurality of eligible voting nodes to participate in a vote to validate a classification result of the another device, wherein the availability request specifies a set of labels each of the plurality of eligible voting nodes must use to validate the classification results of the another device; discovering, by the device, a plurality of possible voting nodes in the computer network before conducting the vote, wherein each of the plurality of possible voting nodes executes at least one classifier that is configured to select a label from among a plurality of labels as an output based on a set of input features; dynamically selecting, by the device from among the plurality of possible voting nodes, a subset of the plurality of possible voting nodes as the plurality of eligible voting nodes based on the set of labels in the availability request; sending, by the device, voting requests only to the selected plurality of eligible voting nodes, wherein the voting requests cause the plurality of eligible voting nodes to vote on the validity of the classification result; receiving, at the device, the votes from the selected plurality of eligible voting nodes that include the selected labels; and validating, by the device, the classification results of the another device based on a voting result received from the selected plurality of eligible voting nodes.

2 . The method as in claim 1 , wherein the availability request is sent as multicast messages.

3 . The method as in claim 1 , wherein the availability request specifies a set of one or more target nodes to be classified.

4 . The method as in claim 1 , wherein the plurality of possible voting nodes are further selected based on a threshold number of the plurality of possible voting nodes in a particular administrative domain that may be included in the plurality of eligible voting nodes.

5 . The method as in claim 1 , wherein a policy engine on the device limits the set of input features used by a particular node in the plurality of eligible voting nodes.

6 . The method as in claim 1 , wherein the voting requests include values for the set of input features.

7 . The method as in claim 1 , wherein the received votes include confidence values associated with the selected labels, and wherein the voting result is determined by weighting the votes using the confidence values.

8 . The method as in claim 1 , wherein one or more classification tasks executing on at least one of the plurality of eligible voting nodes are configured to determine whether a denial of service (DoS) attack is present in the computer network.

9 . The method as in claim 1 , wherein the voting requests include identifiers for the set of input features that cause the plurality of eligible voting nodes to retrieve values for the set of input features and to use the retrieved values to generate the labels.

10 . An apparatus, comprising:
one or more network interfaces to communicate with a computer network; a processor coupled to the network interfaces and adapted to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to:
receive an availability request that requests the apparatus discover a plurality of eligible voting nodes to participate in a vote to validate a classification result of another device in the computer network, wherein the availability request specifies a set of labels each of the plurality of eligible voting nodes must use to validate the classification results of the another device;
discover a plurality of possible voting nodes in the computer network before conducting the vote, wherein each of the plurality of possible voting nodes executes at least one classifier that is configured to select a label from among a plurality of labels as an output based on a set of input features;
select, from among the plurality of possible voting nodes, a subset of the plurality of possible voting nodes as the plurality of eligible voting nodes based on the set of labels in the availability request;
send voting requests only to the selected plurality of eligible voting nodes, wherein the voting requests cause the plurality of eligible voting nodes to vote on the validity of the classification result;
receive votes from the selected plurality of eligible voting nodes that include the selected labels; and
validate the classification results of the another device based on a voting result received from the selected plurality of eligible voting nodes.

11 . The apparatus as in claim 10 , wherein the availability request is sent as multicast messages.

12 . The apparatus as in claim 10 , wherein the availability request specifies a set of one or more target nodes to be classified.

13 . The apparatus as in claim 10 , wherein the plurality of possible voting nodes are further selected based on a threshold number of plurality of possible voting nodes in a particular administrative domain that may be included in the plurality of eligible voting nodes.

14 . The apparatus as in claim 10 , wherein a policy engine limits the set of input features used by a particular node in the plurality of eligible voting nodes.

15 . The apparatus as in claim 10 , wherein the voting requests include values for the set of input features.

16 . The apparatus as in claim 10 , wherein the received votes include confidence values associated with the generated labels, and wherein the voting result is determined by weighting the votes using the confidence values.

17 . The apparatus as in claim 10 , wherein one or more classification tasks executing on at least one of the plurality of eligible voting nodes are configured to determine whether a denial of service (DoS) attack is present in the computer network.

18 . The apparatus as in claim 10 , wherein the voting requests include identifiers for the set of input features that cause the plurality of eligible voting nodes to retrieve values for the set of input features and to use the retrieved values to generate the labels.

19 . A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:
receive an availability request that requests the apparatus discover a plurality of eligible voting nodes to participate in a vote to validate a classification result of another device in the computer network, wherein the availability request specifies a set of labels each of the plurality of eligible voting nodes must use to validate the classification results of the another device; discover a plurality of possible voting nodes in the computer network before conducting the vote, wherein each of the plurality of possible voting nodes executes at least one classifier that is configured to select a label from among a plurality of labels as an output based on a set of input features; select, from among the plurality of possible voting nodes, a subset of the plurality of possible voting nodes as the plurality of eligible voting nodes based on the set of labels in the availability request; send voting requests only to the selected plurality of eligible voting nodes, wherein the voting requests cause the plurality of eligible voting nodes to vote on the validity of the classification result; receive votes from the selected plurality of eligible voting nodes tha

Assignees

• Cisco Tech Inc

Inventors

• Cruz Mota Javier
• Vasseur Jean-Philippe
• Di Pietro Andrea

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title