HIDDEN MARKOV MODEL BASED ARCHITECTURE TO MONITOR NETWORK NODE ACTIVITIES AND PREDICT RELEVANT PERIODS

• US 20140222997A1
• Filed: 07/31/2013
• Published: 08/07/2014
• Est. Priority Date: 02/05/2013
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Mermoud, Grgory, Vasseur, Jean-Philippe, Dasgupta, Sukrit
• Application Number:
  US13/955,648
• Publication Number:
  US 20140222997A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/065 related to network devices

Abstract

In one embodiment, techniques are shown and described relating to a Hidden Markov Model based architecture to monitor network node activities and predict relevant periods. In particular, in one embodiment, a device determines a statistical model for each of one or more singular-node traffic profiles (e.g., based on one or more Hidden Markov Models (HMMs) each corresponding to a respective one of the one or more traffic profiles). By analyzing respective traffic from individual nodes in a computer network, and matching the respective traffic against the statistical model for the one or more traffic profiles, the device may detecting a matching traffic profile for the individual nodes in a computer network. In addition, the device may predict relevant periods of traffic for the individual nodes by extrapolating a most-likely future sequence based on prior respective traffic of the individual nodes and the corresponding matching traffic profile.

Claims

1. A method, comprising:

determining a statistical model for each of one or more singular-node traffic profiles;

detecting a matching traffic profile for individual nodes in a computer network by analyzing respective traffic from the individual nodes and matching the respective traffic against the statistical model for the one or more traffic profiles; and

predicting relevant periods of traffic for the individual nodes by extrapolating a most-likely future sequence based on prior respective traffic of the individual nodes and the corresponding matching traffic profile.

2. The method as in claim 1, further comprising:

informing a task manager of the relevant periods.

3. The method as in claim 1, further comprising:

receiving instructions from a task manager indicating one or more of;

a target node, time window of minimum traffic, time window of maximum traffic, an expected duration of a task, an expiration time for a task, and a desired confidence of relevant periods.

4. The method as in claim 3, further comprising:

determining that there are no predicted relevant periods within the expiration time for the task; and

replying to the task manager with a notification that there are no predicted relevant periods within the expiration time for the task.

5. The method as in claim 1, wherein a relevant period comprises one of either a time at which respective traffic of an individual node is expected to match the corresponding traffic profile or a time at which respective traffic of an individual node is expected to not match the corresponding traffic profile.

6. The method as in claim 1, wherein determining the statistical model for each of one or more singular-node traffic profiles is based on one or more Hidden Markov Models (HMMs) each corresponding to a respective one of the one or more traffic profiles.

7. The method as in claim 6, further comprising:

grouping individual nodes into groups; and

assigning a respective individual HMM per corresponding traffic profile to each group.

8. The method as in claim 6, further comprising:

assigning a single HMM per corresponding traffic profile to all nodes in the network.

9. The method as in claim 6, further comprising:

defining observed variables of the one or more HMMs as multi-dimensional traffic data, wherein each dimension of the multi-dimensional traffic data corresponds to a different type of traffic, averaged on a given time interval.

10. The method as in claim 9, further comprising:

selecting a granularity of traffic types to apply to the multi-dimensional traffic data for a given HMM of the one or more HMMs.

11. The method as in claim 9, wherein a length of the given time interval for a given HMM is based on a pattern of interest.

12. The method as in claim 1, further comprising:

determining that no matching traffic profile exists for particular traffic; and

classifying an unknown traffic profile based on the particular traffic.

13. The method as in claim 1, wherein the one or more singular-node traffic profiles are known a priori and configured on a detecting and predicting device.

14. An apparatus, comprising:

one or more network interfaces to communicate with a computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

determine a statistical model for each of one or more singular-node traffic profiles;

detect a matching traffic profile for individual nodes in the computer network by analyzing respective traffic from the individual nodes and matching the respective traffic against the statistical model for the one or more traffic profiles; and

predict relevant periods of traffic for the individual nodes by extrapolating a most-likely future sequence based on prior respective traffic of the individual nodes and the corresponding matching traffic profile.

15. The apparatus as in claim 14, wherein the process when executed is further operable to:

inform a task manager of the relevant periods.

16. The apparatus as in claim 14, wherein the process when executed is further operable to:

receive instructions from a task manager indicating one or more of;

a target node, time window of minimum traffic, time window of maximum traffic, an expected duration of a task, an expiration time for a task, and a desired confidence of relevant periods.

17. The apparatus as in claim 16, wherein the process when executed is further operable to:

determine that there are no predicted relevant periods within the expiration time for the task; and

reply to the task manager with a notification that there are no predicted relevant periods within the expiration time for the task.

18. The apparatus as in claim 14, wherein determining the statistical model for each of one or more singular-node traffic profiles is based on one or more Hidden Markov Models (HMMs) each corresponding to a respective one of the one or more traffic profiles.

19. The apparatus as in claim 18, wherein the process when executed is further operable to:

group individual nodes into groups; and

assign a respective individual HMM per corresponding traffic profile to each group.

20. The apparatus as in claim 18, wherein the process when executed is further operable to:

assign a single HMM per corresponding traffic profile to all nodes in the network.

21. The apparatus as in claim 18, wherein the process when executed is further operable to:

define observed variables of the one or more HMMs as multi-dimensional traffic data, wherein each dimension of the multi-dimensional traffic data corresponds to a different type of traffic, averaged on a given time interval.

22. The apparatus as in claim 14, wherein the process when executed is further operable to:

determine that no matching traffic profile exists for particular traffic; and

classify an unknown traffic profile based on the particular traffic.

23. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

determine a statistical model for each of one or more singular-node traffic profiles;

detect a matching traffic profile for individual nodes in the computer network by analyzing respective traffic from the individual nodes and matching the respective traffic against the statistical model for the one or more traffic profiles; and

predict relevant periods of traffic for the individual nodes by extrapolating a most-likely future sequence based on prior respective traffic of the individual nodes and the corresponding matching traffic profile.

24. The computer-readable media as in claim 23, wherein determining the statistical model for each of one or more singular-node traffic profiles is based on one or more Hidden Markov Models (HMMs) each corresponding to a respective one of the one or more traffic profiles.