LEARNING MACHINE BASED DETECTION OF ABNORMAL NETWORK PERFORMANCE

• US 20140222998A1
• Filed: 07/31/2013
• Published: 08/07/2014
• Est. Priority Date: 02/05/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Vasseur, Jean-Philippe, Mermoud, Grgory, Dasgupta, Sukrit
• Granted Patent: US 9,628,362 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: Y04S 40/00 Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them

Abstract

In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties x_i and network performance metrics M_i from a network management server (NMS), and then intercepts x_i and M_i transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on x_i and M_i, and can detect one or more anomalies in the intercepted x_i and M_i based on the regression function F. In another embodiment, the NMS, which instructed the border router, receives the detected anomalies from the border router.

Claims

1. A method, comprising:

receiving, at a border router from a network management server (NMS), a set of network properties x_i and network performance metrics M_i;

intercepting x_i and M_i transmitted from nodes in a computer network of the border router;

building a regression function F based on x_i and M_i; and

detecting one or more anomalies in the intercepted x_i and M_i based on the regression function F.

2. The method as in claim 1, further comprising:

reporting the one or more detected anomalies to the NMS.

3. The method as in claim 1, further comprising:

reporting the regression function F to the NMS.

4. The method as in claim 1, wherein building the regression function F comprises:

determining relevant features f_j(x) to use as input to a regression algorithm to determine a function F(x).

5. The method as in claim 4, wherein determining relevant features f_j(x) comprises:

populating a list with a plurality of features; and

removing from the list those features that are irrelevant to prediction of M_i.

6. The method as in claim 5, wherein populating comprises:

generating a plurality of features with a feature construction algorithm that randomly pairs operators to one of either constant values or input dimensions.

7. The method as in claim 5, further comprising:

determining whether features are irrelevant to prediction of M_i based on a Variational Bayes Least Square (VBLS) based weight of a corresponding feature.

8. The method as in claim 1, further comprising:

probing for M_i.

9. The method as in claim 8, wherein probing comprises:

probing for M_i from nodes n_j that yield a maximum divergence in terms of prediction of M_i among all candidate solutions.

10. A method, comprising:

determining, by a network management server (NMS), a set of network properties x_i and network performance metrics M_i;

sending the set of network properties x_i and network performance metrics M_i to a border router of a computer network; and

receiving, from the border router, one or more detected anomalies in intercepted x_i and M_i transmitted from nodes in the computer network based on a regression function F built by the border router based on x_i and M_i.

11. The method as in claim 10, further comprising:

receiving, at the NMS, the regression function F from the border router.

12. An apparatus, comprising:

one or more network interfaces to communicate as a border router with a computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive, from a network management server (NMS), a set of network properties x_i and network performance metrics M_i;

intercept x_i and M_i transmitted from nodes in the computer network;

build a regression function F based on x_i and M_i; and

detect one or more anomalies in the intercepted x_i and M_i based on the regression function F.

13. The apparatus as in claim 12, wherein the process when executed is further operable to:

report the one or more detected anomalies to the NMS.

14. The apparatus as in claim 12, wherein the process when executed is further operable to:

report the regression function F to the NMS.

15. The apparatus as in claim 12, wherein the process when executed to build the regression function F is further operable to:

determine relevant features f_j(x) to use as input to a regression algorithm to determine a function F(x).

16. The apparatus as in claim 15, wherein the process when executed to determine relevant features f_j(x) is further operable to:

populate a list with a plurality of features; and

remove from the list those features that are irrelevant to prediction of M_i.

17. The apparatus as in claim 16, wherein the process when executed to populate is further operable to:

generate a plurality of features with a feature construction algorithm that randomly pairs operators to one of either constant values or input dimensions.

18. The apparatus as in claim 16, wherein the process when executed is further operable to:

determine whether features are irrelevant to prediction of M_i based on a Variational Bayes Least Square (VBLS) based weight of a corresponding feature.

19. The apparatus as in claim 12, wherein the process when executed is further operable to:

probe for M_i.

20. The apparatus as in claim 19, wherein the process when executed to probe is further operable to:

probe for M_i from nodes n_j that yield a maximum divergence in terms of prediction of M_i among all candidate solutions.

21. An apparatus, comprising:

one or more network interfaces to communicate as a network management server (NMS) with a border router of a computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

determine a set of network properties x_i and network performance metrics M_i;

send the set of network properties x_i and network performance metrics M_i to a border router of a computer network; and

receive, from the border router, one or more detected anomalies in intercepted x_i and M_i transmitted from nodes in the computer network based on a regression function F built by the border router based on x_i and M_i.

22. The apparatus as in claim 21, wherein the process when executed is further operable to:

receive the regression function F from the border router.