Sparse coding of hidden states for explanatory purposes

• US 10,212,044 B2
• Filed: 03/23/2017
• Issued: 02/19/2019
• Est. Priority Date: 03/23/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Mermoud, Gregory, Savalle, Pierre-Andre, Vasseur, Jean-Philippe, Mota, Javier Cruz
• Primary Examiner(s): Dinh, Khanh Q
• Application Number:
  US15/466,969
• Publication Number:
  US 20180278487A1
• Time in Patent Office: 698 Days
• Field of Search: 709203, 709220, 709224, 709226, 709228, 709232
• CPC Class Codes: G06N 3/044 Recurrent networks, e.g. Hopfield networks
• CPC Class Codes: G06N 3/047 Probabilistic or stochastic networks
• CPC Class Codes: G06N 3/08 Learning methods
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/149 for prediction of maintenance
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 7/163 by receiver means only

Abstract

In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors. The device provides a label for the particular state vector to a user interface. The label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors.

Claims

1. A method comprising:

maintaining, by a device in a network, a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network;

applying, by the device, sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model, wherein the decomposition of the particular state vector comprises a plurality of basis vectors;

determining, by the device, a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors;

providing, by the device, a label for the particular state vector to a user interface, wherein the label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors;

determining, by the device, that a particular one of the basis vectors does not have a human-readable interpretation based on the mapping; and

ignoring, by the device, the particular basis vector when generating the label for the state vector.

2. The method as in claim 1, wherein the monitored entity comprises at least one of:

a router in the network, a switch in the network, a wireless controller in the network, or an access point in the network.

3. The method as in claim 1, wherein determining the mapping between the at least one of the plurality of basis vectors for the particular state vector and the human-readable interpretations of the basis vectors comprises:

receiving, at the device, one or more descriptions for the plurality of basis vectors from the user interface; and

using, by the device, the one or more descriptions to form the human-readable interpretations of the basis vectors.

4. The method as in claim 3, wherein using the one or more descriptions to form the human-readable interpretations of the basis vectors comprises:

clustering, by the device, two or more of the descriptions into a human-readable interpretation.

5. The method as in claim 1, wherein determining the mapping between at least one of the plurality of basis vectors for the particular state vector and the human-readable interpretations of the basis vectors comprises:

applying, by the device, a machine learning-based classifier to the observations.

6. The method as in claim 5, wherein the classifier is trained to identify entities in the network that are associated with a particular one of the basis vectors.

7. The method as in claim 1, wherein the machine learning-based recursive model comprises a recurrent neural network (RNN).

8. The method as in claim 1, wherein the device is part of a cloud-based network assurance system.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

maintain a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network;

apply sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model, wherein the decomposition of the particular state vector comprises a plurality of basis vectors;

determine a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors; and

provide a label for the particular state vector to a user interface, wherein the label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors.

10. The apparatus as in claim 9, wherein the monitored entity comprises at least one of:

a router in the network, a switch in the network, a wireless controller in the network, or an access point in the network.

11. The apparatus as in claim 9, wherein the apparatus determines the mapping between the at least one of the plurality of basis vectors for the particular state vector and the human-readable interpretations of the basis vectors by:

receiving one or more descriptions for the plurality of basis vectors from the user interface; and

using the one or more descriptions to form the human-readable interpretations of the basis vectors.

12. The apparatus as in claim 11, wherein the apparatus uses the one or more descriptions to form the human-readable interpretations of the basis vectors by:

clustering two or more of the descriptions into a human-readable interpretation.

13. The apparatus as in claim 9, wherein the apparatus determines the mapping between at least one of the plurality of basis vectors for the particular state vector and the human-readable interpretations of the basis vectors by:

applying a machine learning-based classifier to the observations.

14. The apparatus as in claim 13, wherein the classifier is trained to identify entities in the network that are associated with a particular one of the basis vectors.

15. The apparatus as in claim 9, wherein the machine learning-based recursive model comprises a recurrent neural network (RNN).

16. The apparatus as in claim 9, wherein the apparatus is part of a cloud-based network assurance system.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

maintaining, by the device, a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network;

applying, by the device, sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model, wherein the decomposition of the particular state vector comprises a plurality of basis vectors;

determining, by the device, a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors;

providing, by the device, a label for the particular state vector to a user interface, wherein the label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors;

determining, by the device, that a particular one of the basis vectors does not have a human-readable interpretation based on the mapping; and

ignoring, by the device, the particular basis vector when generating the label for the state vector.

18. The tangible, non-transitory, computer-readable medium as in claim 17, wherein the monitored entity comprises at least one of:

a router in the network, a switch in the network, a wireless controller in the network, or an access point in the network.