ANOMALY DETECTION SUPPORTING NEW APPLICATION DEPLOYMENTS

• US 20170104775A1
• Filed: 10/08/2015
• Published: 04/13/2017
• Est. Priority Date: 10/08/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Vasseur, Jean-Philippe, Dasgupta, Sukrit, Mermoud, Grgory
• Granted Patent: US 9,923,911 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models.

Claims

1. A method, comprising:

maintaining, by a device in a network, information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models;

receiving, at the device, an indication of a planned application deployment in the network; and

adjusting, by the device, an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models.

2. The method as in claim 1, further comprising:

receiving, at the device and from one or more anomaly detectors in the network, the information regarding the anomaly detection models and the applications associated with the traffic analyzed by the anomaly detection models.

3. The method as in claim 1, wherein the indication of the planned application deployment in the network comprises at least one of:

an application identifier, data regarding expected traffic changes in the network attributable to the application deployment, or a deployment schedule.

4. The method as in claim 1, wherein adjusting the anomaly detection strategy of the particular anomaly detector comprises:

determining, by the device, that the planned application deployment relates to one of the applications associated with the traffic analyzed by a particular anomaly detection model of the anomaly detection models; and

providing, by the device, the particular anomaly detection model to the particular anomaly detector.

5. The method as in claim 1, wherein adjusting the anomaly detection strategy of the particular anomaly detector comprises:

determining, by the device, that the planned application deployment does not relate to one of the applications associated with the traffic analyzed by the anomaly detection models; and

instructing, by the device, the particular anomaly detector to prevent anomaly detection alerts from being sent during the application deployment.

6. The method as in claim 5, further comprising:

receiving, from the particular anomaly detector, a summary of alerts raised by the particular anomaly detector during the application deployment.

7. A method, comprising:

providing, by an anomaly detector in a network, information regarding one or more anomaly detection models executed by the device and the applications associated with the traffic analyzed by the one or more anomaly detection models;

receiving, at the anomaly detector, an indication of a new application to be deployed in the network; and

adjusting, by the anomaly detector, an anomaly detection strategy of the anomaly detector based on the received indication of the new application to be deployed in the network.

8. The method as in claim 7, wherein the indication of the new application to be deployed in the network comprises a particular anomaly detection model that analyzes traffic associated with the new application to be deployed.

9. The method as in claim 8, further comprising:

merging the one or more anomaly detection models executed by the device with the particular anomaly detection model that analyzes traffic associated with the new application to be deployed, to form a merged anomaly detection model.

10. The method as in claim 9, further comprising:

increasing a training rate for the merged anomaly detection model.

11. The method as in claim 7, further comprising:

preventing anomaly detection alerts from being sent during deployment of the new application.

12. The method as in claim 11, further comprising:

summarizing anomaly detection alerts generated during deployment of the new application.

13. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to;

maintain information regarding anomaly detection models used in the network and applications associated with the traffic analyzed by the anomaly detection models;

receive an indication of a planned application deployment in the network; and

adjust an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications is associated with the traffic analyzed by the anomaly detection models.

14. The apparatus as in claim 13, wherein the apparatus adjusts the anomaly detection strategy of the particular anomaly detector by:

determining that the planned application deployment relates to one of the applications associated with the traffic analyzed by a particular anomaly detection model of the anomaly detection models; and

providing the particular anomaly detection model to the particular anomaly detector.

15. The apparatus as in claim 13, wherein the apparatus adjusts the anomaly detection strategy of the particular anomaly detector by:

determining that the planned application deployment does not relate to one of the applications associated with the traffic analyzed by the anomaly detection models; and

instructing the particular anomaly detector to prevent anomaly detection alerts from being sent during the application deployment.

16. The apparatus as in claim 13, wherein the indication of the planned application deployment in the network comprises at least one of:

an application identifier, data regarding expected traffic changes in the network attributable to the application deployment, or a deployment schedule.

17. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to;

provide information regarding one or more anomaly detection models executed by the apparatus and applications associated with the traffic analyzed by one or more anomaly detection models of the apparatus;

receive an indication of a new application to be deployed in the network; and

adjust an anomaly detection strategy of the anomaly detector based on the received indication of the new application to be deployed in the network.

18. The apparatus as in claim 17, wherein the indication of the new application to be deployed in the network comprises a particular anomaly detection model that analyzes traffic associated with the new application to be deployed, and wherein the process when executed is further configured to:

merge the one or more anomaly detection models executed by the apparatus with the particular anomaly detection model that analyzes traffic associated with the new application to be deployed, to form a merged anomaly detection model.

19. The apparatus as in claim 17, wherein the process when executed is further configured to:

prevent anomaly detection alerts from being sent during deployment of the new application.

20. The apparatus as in claim 17, wherein the process when executed is further configured to:

summarize anomaly detection alerts generated during deployment of the new application.