Vector-based anomaly detection
First Claim
1. A method of detecting anomalous behavior of a network fabric, comprising:
- determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other;
disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics, the variation calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector;
aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior, each anomaly criterion status being calculated by a network node as a function of the node'"'"'s anomaly criterion and a measured vector of the at least two different behavior metrics; and
notifying a manager of the fabric anomalous behavior.
3 Assignments
0 Petitions
Accused Products
Abstract
Methods of detecting anomalous behaviors associated with a fabric are presented. A network fabric can comprise many fungible networking nodes, preferably hybrid-fabric apparatus capable of routing general purpose packet data and executing distributed applications. A nominal behavior can be established for the fabric and represented by a baseline vector of behavior metrics. Anomaly detection criteria can be derived as a function of a variation from the baseline vector based on measured vectors of behavior metrics. Nodes in the fabric can provide a status for one or more anomaly criterion, which can be aggregated to determine if an anomalous behavior has occurred, is occurring, or is about to occur.
73 Citations
20 Claims
-
1. A method of detecting anomalous behavior of a network fabric, comprising:
-
determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other; disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics, the variation calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector; aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior, each anomaly criterion status being calculated by a network node as a function of the node'"'"'s anomaly criterion and a measured vector of the at least two different behavior metrics; and notifying a manager of the fabric anomalous behavior. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A non-transitory computer readable medium comprising instructions for:
-
determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other; disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics, the variation calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector; aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior, each anomaly criterion status being calculated by a network node as a function of the node'"'"'s anomaly criterion and a measured vector of the at least two different behavior metrics; and notifying a manager of the fabric anomalous behavior. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
-
Specification