Hierarchical event detection in a computer network

• US 9,450,978 B2
• Filed: 01/27/2014
• Issued: 09/20/2016
• Est. Priority Date: 01/06/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Vasseur, Jean-Philippe, Cruz Mota, Javier, Di Pietro, Andrea
• Primary Examiner(s): Starks, Wilbert L
• Application Number:
  US14/164,460
• Publication Number:
  US 20150193696A1
• Time in Patent Office: 967 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/02 Neural networks
• CPC Class Codes: G06N 3/08 Learning methods
• CPC Class Codes: G06N 3/084 Backpropagation, e.g. using gradient descent
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 45/48 Routing tree calculation
• CPC Class Codes: H04L 47/127 by using congestion prediction
• CPC Class Codes: H04L 47/2466 using signalling traffic
• CPC Class Codes: H04L 47/41 by acting on aggregated flows or links
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

In one embodiment, network data is received at a first node in a computer network. A low precision machine learning model is used on the network data to detect a network event. A notification is then sent to a second node in the computer network that the network event was detected, to cause the second node to use a high precision machine learning model to validate the detected network event.

Claims

1. A method, comprising:

receiving network data at a first node in a computer network;

using a low precision machine learning model on the network data to detect a network event; and

sending a notification to a second node in the computer network that the network event was detected, the notification to cause the second node to use a high precision machine learning model to validate the detected network event, wherein the second node is a field area router (FAR).

2. The method as in claim 1, wherein the first node has lower computing resources than the second node.

3. The method as in claim 1, wherein the machine learning models are artificial neural network (ANNs).

4. The method as in claim 1, further comprising:

receiving, from the second node, a request for information regarding the detected network event; and

sending the requested information regarding the detected network event to the second node.

5. The method as in claim 1, wherein the notification sent to the second node comprises the network data used to detect the network event.

6. The method as in claim 1, further comprising:

receiving a request for computational resources available at the first node from the second node;

providing the available computational resources to the second node; and

receiving the low precision machine learning model from the second node based on the computational resources available at the first node.

7. The method as in claim 1, further comprising:

receiving an eligibility request from the second node;

determining whether the first node is eligible to execute the low precision machine learning model based on computational resources available at the first node;

notifying the second node that the first node is eligible to execute the low precision machine learning model; and

receiving, from the second node, the low precision machine learning model.

8. The method as in claim 1, wherein the second node determines the network event detected by the first node to be a false positive using the high precision machine learning model.

9. An apparatus, comprising:

one or more network interfaces to communicate in a computer network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive network data in the computer network;

use a low precision machine learning model on the network data to detect a network event; and

send a notification to another node in the computer network that the network event was detected, the notification to cause the other node to use a high precision machine learning model to validate the detected network event, wherein the other node is a field area router (FAR).

10. The apparatus as in claim 9, wherein the machine learning models are artificial neural network (ANNs).

11. The apparatus as in claim 9, wherein the process when executed is further operable to:

receive, from the other node, a request for information regarding the detected network event; and

send the requested information regarding the detected network event to the other node.

12. The apparatus as in claim 9, wherein the process when executed is further operable to:

receive a request for computational resources available at the apparatus from the other node;

provide the available computational resources to the other node; and

receive the low precision machine learning model from the other node based on the available computational resources.

13. The apparatus as in claim 9, wherein the process when executed is further operable to:

receive an eligibility request from the second node;

determine whether the first node is eligible to execute the low precision machine learning model based on computational resources available at the first node;

notify the second node that the first node is eligible to execute the low precision machine learning model; and

receive, from the second node, the low precision machine learning model.

14. A method, comprising:

receiving, at a node in a computer network, a notification that a network event was detected by another node in the computer network using a low precision machine learning model;

receiving network data used by the other node to detect the network event;

validating the detected network event using the network data with a high precision machine learning model; and

determining that the network event detected by the other node using the low precision machine learning model was a false positive.

15. The method as in claim 14, further comprising:

requesting, from the other node, data regarding computing resources available at the other node;

determining that the other node is eligible to execute the low precision machine learning model; and

sending the low precision machine learning model to the other node.

16. The method as in claim 14, further comprising:

determining that a particular node cannot execute the low precision machine learning model;

requesting network data from the particular node;

receiving the requested network data from the particular node;

using the network data received from the particular node to detect the network event.

17. The method as in claim 14, wherein the network event is validated in response to receiving notifications that the network event was detected by a plurality of network nodes using low precision machine learning models.

18. An apparatus, comprising:

one or more network interfaces to communicate in a computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive a notification that a network event was detected by another node in the computer network using a low precision machine learning model;

receive network data used by the other node to detect the network event; and

validate the detected network event using the network data with a high precision machine learning model; and

determine that the network event detected by the other node using the low precision machine learning model was a false positive.